pudgypenguin[.]trade

The domain pudgypenguin.trade was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on January 13, 2026. Passive DNS observation shows the name resolving to the IP address 172.67.219.162, which belongs to Cloudflare, Inc. (ASN 13335) and is geolocated in the United States. The site presented the HTTP response title "Just a moment..." before being taken offline, and the SSL certificate presented is identified as WE1. Threat intelligence sources list the domain on a single security blocklist, where it is actively blocked by PhishDestroy.

VirusTotal scans recorded three positive detections out of ninety‑three vendor engines, indicating that multiple security products have flagged the host as malicious. Additionally, Gridinsoft assigned a trust score of 0 out of 100, reflecting a complete lack of confidence in the domain’s legitimacy. Current operational status is offline, which limits further real‑time analysis of payloads or page content. The available evidence confirms that pudgypenguin.trade was used for a generic phishing campaign, but the specific lures, credential‑stealing techniques, or targeted brands remain unknown due to the limited visibility of the page content.

Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the associated Cloudflare IP range, and correlate any authentication attempts originating from this address with user activity logs. Ongoing reconnaissance should include periodic re‑resolution of the domain, verification of any reinstated SSL certificates, and re‑submission to multi‑engine scanners to capture any changes in malicious behavior. Until the domain reappears, maintaining the existing blocklist entry and monitoring for related infrastructure artifacts is recommended.