claim-pengu[.]live

This domain, claim-pengu.live, was identified as a high-risk brand impersonation operation targeting Ethereum cryptocurrency users. The site masqueraded as an official distribution portal for the $PENGU token, associated with the Pudgy Penguins NFT collection, using the page title 'Claim Your $PENGU | Pudgy Penguins.' Analysis indicates the campaign was designed to deceive users into connecting wallets to a malicious smart contract, likely functioning as a crypto drainer to siphon assets without authorization. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It resolved to the IP address 144.31.254.56, hosted under AS213877 (U1 DIGITAL SERVICES LTD) in Germany. The domain lacked an SSL certificate, increasing exposure to interception risks. Detection metrics confirm its malicious nature: Google Safe Browsing flagged it as phishing, and 22 out of 95 security vendors on VirusTotal classified it as malicious. Additionally, the domain appeared on three independent security blocklists and was proactively blocked by multiple wallet security layers. As of the latest assessment, claim-pengu.live has been taken offline, though residual risk persists due to potential re-registration or migration to alternative domains. Users who interacted with the site are advised to revoke any connected wallet permissions and audit transaction histories for unauthorized activity. The use of unregistered domains with short lifespans and bulletproof hosting providers remains a recurring tactic in cryptocurrency phishing campaigns, underscoring the need for continuous monitoring of emerging threats.