hmsfuar[.]com

This domain, hmsfuar.com, is flagged as a high-risk generic phishing site targeting users of the Pudgy Penguins NFT project. The page displays a fraudulent "Claim Your $PENGU" interface, designed to trick victims into connecting cryptocurrency wallets to a malicious smart contract or drainer kit. The threat actor likely exploits the popularity of the Pudgy Penguins brand and its associated $PENGU token to facilitate unauthorized asset transfers from compromised wallets. Analysis indicates the domain was registered on June 14, 2021, through Atak Domain and currently resolves to the IP address 46.20.146.46, hosted on AS48737 (DoraTelekom) in Turkey. The domain is present on 4 security blocklists, and VirusTotal reports 8 out of 95 security vendors flagging it as malicious. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites. No Google Safe Browsing (GSB) data is referenced in the available intelligence, but the domain is actively blocked by multiple wallet security tools. As of the latest assessment, hmsfuar.com remains active and continues to pose a significant risk to users. Response actions include its inclusion on multiple blocklists and real-time blocking by cryptocurrency wallet protection mechanisms. However, the domain's persistence and the use of a valid SSL certificate may lend it an appearance of legitimacy. Users are advised to verify token claim websites through official project channels and avoid interacting with domains not explicitly linked to verified Pudgy Penguins sources. Infrastructure analysis reveals no signs of takedown, indicating the threat actor maintains operational control.