pengervests[.]com

This domain, pengervests.com, operates as a credential harvesting platform designed to mimic legitimate financial investment services. Analysis indicates the site presents itself as "PengerVest," a fabricated entity likely targeting users seeking investment or banking services. The page employs social engineering tactics, including a professional interface with interactive elements such as live chat (Smartsupp) and responsive design frameworks (Bootstrap), to deceive visitors into submitting sensitive information such as usernames, passwords, and financial details. The use of HTTP/3 and LiteSpeed technologies further suggests an attempt to appear technologically credible while obscuring malicious intent behind modern web protocols. Infrastructure analysis reveals multiple technical indicators supporting its classification as a phishing domain. The domain was registered on July 19, 2023, through HOSTINGER operations, UAB, a registrar frequently associated with low-cost, short-lived malicious domains. It resolves to the IP address 198.251.84.200, which has been flagged in at least one security blocklist. On VirusTotal, 2 out of 95 security vendors have detected the domain as malicious, a relatively low but non-zero detection rate that may reflect evasion techniques or recent activation. Additionally, the domain has been blocked by PhishDestroy, a specialized anti-phishing system, and received a trust score of 25/100 from Gridinsoft, indicating elevated risk. The combination of recent registration, minimal detection, and targeted financial impersonation suggests a calculated effort to evade automated defenses. Users who visited pengervests.com should take immediate remedial action to mitigate potential exposure. If any credentials or personal information were entered on the site, those details should be considered compromised and changed immediately across all platforms where they were reused. Affected individuals should monitor financial accounts for unauthorized transactions and enable multi-factor authentication where available. System scans using updated security tools are recommended to detect any secondary payloads or tracking mechanisms that may have been deployed. Given the domain’s current offline status, further direct interaction is unlikely; however, users should remain vigilant against follow-up phishing attempts via email or messaging platforms, as attackers often reuse harvested data in subsequent campaigns.