pengu[.]exchange

This domain is flagged as a crypto drainer phishing site targeting users with fraudulent wallet-draining mechanisms. Analysis indicates the infrastructure is designed to mimic legitimate exchange or wallet services, likely exploiting users through deceptive prompts to connect wallets or input recovery phrases. The Japanese page title "しばらくお待ちください..." ("Please wait a moment...") suggests a localized or obfuscated attack vector, potentially serving as a placeholder or redirect to malicious payloads. Infrastructure analysis reveals the domain was registered on December 30, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk registrations. It resolves to IP address 172.67.161.233, a Cloudflare-protected endpoint leveraging HTTP/3 and HSTS for apparent legitimacy. Despite 0 detections across 95 VirusTotal engines, the domain appears on 3 security blocklists and is referenced in 1 AlienVault OTX threat intelligence pulse. The SSL certificate is issued by Google Trust Services, a common tactic to evade initial scrutiny. MetaMask, SEAL, and PhishDestroy have preemptively blocked access, indicating prior detection of malicious behavior. Mitigation steps for this crypto drainer threat include immediate blacklisting of the domain and IP in network security controls. Organizations should monitor for connections to 172.67.161.233 and alert on any attempts to access pengu.exchange. Users should be educated to verify domain authenticity before connecting wallets or entering credentials, particularly for services impersonating exchanges. Given the domain's recent creation and Cloudflare obfuscation, security teams should prioritize retroactive log analysis for any prior interactions with this infrastructure. Blocking domains registered via NiceNIC with similar patterns (e.g., future-dated creation, Cloudflare hosting) may preemptively disrupt related campaigns.