pudgypenguines[.]pro

This domain operates as a crypto phishing endpoint designed to harvest wallet credentials and private keys. Victims are typically redirected to fake authentication pages mimicking legitimate blockchain services, where entered credentials are captured and transmitted to attacker-controlled infrastructure. The site employs social engineering tactics, such as urgent transaction prompts or fake airdrop claims, to manipulate users into disclosing sensitive information. Analysis indicates the domain is part of a broader campaign targeting cryptocurrency holders, with infrastructure hosted behind Cloudflare to obscure origin servers and evade takedowns. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on October 14, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with malicious domains. It resolves to 188.114.97.3, a Cloudflare IP address (AS13335) commonly used to mask hosting providers. At the time of detection, 16 out of 95 security vendors on VirusTotal flagged the domain as malicious, with three major blocklists—including MetaMask and SEAL—actively blocking access. The absence of an SSL certificate further suggests a low-effort, disposable phishing operation, as modern browsers flag HTTP-only sites as insecure, potentially reducing victim trust. If this domain was visited, immediate action is required to mitigate credential theft. Disconnect the device from the network to prevent data exfiltration and revoke any active sessions on cryptocurrency wallets or exchanges. Reset passwords and private keys for all associated accounts, prioritizing those used during the suspected exposure window. Monitor wallet addresses for unauthorized transactions and enable transaction signing confirmation for future activities. Report the incident to relevant blockchain security teams and consider filing a complaint with the registrar, NiceNIC International Group Co., Limited, citing the domain’s creation date and malicious status. Users should also check local hosts files and browser extensions for unauthorized modifications linked to this domain.