pengu-airdrop[.]app

Analysis of the domain pengu-airdrop.app indicates it is an active crypto drainer phishing site, classified as high-risk based on observable infrastructure and threat intelligence. The domain was registered on April 17, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. It currently resolves to the IP address 104.21.69.74, hosted on Cloudflare infrastructure in Canada, which is commonly used to obfuscate the true origin of phishing sites. The domain utilizes Cloudflare nameservers (candy.ns.cloudflare.com and lynn.ns.cloudflare.com), further complicating attribution and takedown efforts. Threat intelligence sources provide strong evidence of malicious activity. Gridinsoft assigns the domain a trust score of 0/100, and it appears in one AlienVault OTX threat intelligence pulse, suggesting prior detection in security communities. The domain is also present on one security blocklist and is actively blocked by PhishDestroy. While VirusTotal reports only one detection out of 94 vendors, this does not diminish the confirmed malicious classification, as detection rates often vary based on vendor signatures and scanning methodologies. The domain’s HTTP status is 403, which may indicate an attempt to restrict access to evade analysis or automated crawlers, though the site remains operational for targeted victims. The scam type is identified as a fake airdrop, a common tactic used to deceive cryptocurrency users into connecting wallets to malicious smart contracts, resulting in unauthorized fund transfers. The SSL certificate is issued by Let’s Encrypt, a legitimate provider, which is frequently exploited by threat actors to lend a false sense of legitimacy to phishing domains. The page title, 'Just a moment...', is consistent with Cloudflare interstitial pages but may also serve as a placeholder or evasion technique. Defenders should treat this domain as an active threat. Network-level blocking of the IP 104.