penpie-magpie[.]cc

This domain is flagged as an elevated-risk phishing portal specifically designed to harvest cryptocurrency wallet credentials through fraudulent decentralized finance (DeFi) staking interfaces. Analysis indicates the site impersonates legitimate staking platforms to deceive users into connecting their wallets, enabling unauthorized fund transfers and private key exposure. Infrastructure analysis reveals multiple high-confidence threat indicators. The domain penpie-magpie.cc was registered on April 16, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. It resolves to IP address 188.114.97.3, which hosts multiple phishing sites targeting financial services. Security vendors on VirusTotal flagged the domain with 6/95 detections, confirming malicious intent. The domain appears on one security blocklist and was documented in a threat intelligence pulse on AlienVault OTX. Despite using a Google Trust Services SSL certificate, the site's infrastructure and behavioral patterns align with credential harvesting operations. Mitigation requires immediate action from both users and network defenders. Users who interacted with penpie-magpie.cc should revoke all connected wallet authorizations, rotate private keys, and monitor accounts for unauthorized transactions. Network administrators should implement DNS-based blocking of the domain and its associated IP address 188.114.97.3. Security teams should prioritize monitoring for connections to this infrastructure, particularly from endpoints that handle cryptocurrency transactions. Given the domain's current offline status, continuous monitoring is essential to detect potential re-emergence under similar naming conventions or infrastructure.