drop-pengu[.]fun

Analysis of the domain drop-pengu.fun, observed on 24 July 2026, indicates that it was registered on 21 February 2026 and subsequently used in a crypto‑related scam campaign identified as an “Airdrop Scam”. The site presented the page title "Airdrop Hero", which aligns with the known phishing kit named "Airdrop Scam". DNS resolution points to the IP address 172.67.167.200, an address owned by AS13335 Cloudflare, Inc. and geolocated to the United States. The SSL certificate associated with the host is identified as "WE1", suggesting a publicly trusted certificate but offering no additional mitigation.

VirusTotal analysis recorded a single positive detection out of 95 scanned security vendors, confirming that at least one vendor flagged the domain as malicious. The domain also appears on a single external blocklist and has been explicitly added to the PhishDestroy blocklist, reinforcing its classification as a threat. Current network measurements show the domain as offline, indicating that the malicious site has been taken down or is no longer serving content. While the available intelligence confirms the presence of a crypto‑airdrop phishing kit and a modest detection footprint, the depth of the payload, credential‑harvesting mechanisms, and any additional command‑and‑control infrastructure remain unknown because the site is not presently reachable.

No further information about the SSL certificate issuer, certificate validity period, or additional hosting services was provided. Consequently, defenders should continue to enforce blocklist rules for drop-pengu.fun, monitor traffic to the associated Cloudflare IP for any residual activity, and consider adding the IP to network‑level deny lists. Organizations that have exposed cryptocurrency wallets or that monitor for airdrop‑related phishing should treat any inbound connections from this domain as malicious.