s2-pengu[.]com

The domain s2-pengu.com was registered through Dynadot LLC on November 19, 2025 and is currently taken offline. DNS resolution shows the domain pointing to IP address 216.58.206.68, which is allocated to ASN15169 belonging to Google LLC in Germany. The hosting service is provided by Cloudflare, with both brenna.ns.cloudflare.com and hassan.ns.cloudflare.com listed as authoritative name servers, and the site supports HTTP/3. An HTTPS connection presents a certificate issued by Google Trust Services under the WE1 identifier, which may create a false sense of legitimacy for users.

The HTTP response returns a 404 status code, and the page title returned by the server is "Google," offering no direct evidence of malicious content at the time of analysis. VirusTotal scans have flagged the domain by 2 of 95 security vendors, and it appears on a single external blocklist. PhishDestroy has also added the domain to its block list. The threat classification identifies the domain as impersonating Gmail, indicating a brand‑impersonation campaign aimed at deceiving users into believing the site is associated with Google’s email service.

While the current offline status limits immediate interaction, the infrastructure—particularly the use of a legitimate Google‑owned IP and a Google‑issued SSL certificate—suggests a deliberate attempt to leverage trusted resources to increase credibility. Defenders should continue to block the domain at perimeter firewalls and proxy filters, monitor DNS queries for any re‑resolution attempts, and correlate any login‑related alerts with the domain’s activity. Given the limited vendor detections and single blocklist entry, additional telemetry should be collected if the domain reappears, and any related indicators of compromise should be shared with threat‑intel platforms to improve detection coverage.