event-pengu[.]org

Analysis of the domain event-pengu.org indicates active phishing infrastructure targeting users with a fraudulent 'Contact Verification Suspension Page.' The domain was registered on May 11, 2026, through Key-Systems GmbH and currently resolves to IP address 104.21.5.148, hosted on Cloudflare nameservers denver.ns.cloudflare.com and mckenzie.ns.cloudflare.com. The page title explicitly suggests an attempt to deceive users into believing their contact information requires verification or faces suspension, a common phishing tactic to harvest credentials or personal data. Infrastructure review shows the domain is flagged by three security blocklists and has been identified in one AlienVault OTX threat intelligence pulse. Five of 92 security vendors on VirusTotal have detected the domain as malicious, though the absence of detection by the remaining vendors does not confirm safety. The domain maintains an active SSL certificate issued by Let's Encrypt, which is consistent with both legitimate and malicious sites leveraging encryption to appear credible. Defenders should prioritize blocking this domain at the DNS or network level, particularly in environments where user verification prompts are common. Monitoring for connections to 104.21.5.148 or related Cloudflare-hosted infrastructure may help identify compromised endpoints. The exact brand or service being impersonated is not confirmed in available data, and further analysis of the page content is required to determine specific targeting. Given the domain's recent registration and active status, continued vigilance is recommended.