bitcoinpenguins-claim[.]com

bitcoinpenguins-claim.com was registered on 2 September 2025 through NiceNIC International Group Co., Limited. The domain resolves to 104.21.7.25, an address owned by Cloudflare (AS13335) and listed as located in the United States. Nameservers kipp.ns.cloudflare.com and zita.ns.cloudflare.com confirm that the site was fronted by Cloudflare’s CDN. No TLS certificate was observed, indicating that the site was served over HTTP only. The page title retrieved during the brief live window was “Bitcoin Penguins | Meet The Friendliest Birds On The Blockchain,” a thematic reference that does not directly echo the targeted brand.

However, threat intelligence tags the domain as an impersonation of CoinMarketCap, and the scam type is identified as wallet/seed phishing, suggesting an attempt to harvest cryptocurrency credentials. Two of ninety‑five security vendors on VirusTotal flagged the domain, and the site appears on two public blocklists, including PhishDestroy and ScamSniffer. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. The combination of a low trust score, blocklist inclusion, and vendor detections provides sufficient confidence to classify the infrastructure as hostile. Because the domain is currently offline, active exploitation is not observable, but the infrastructure remains usable for future campaigns.

Defenders should immediately add bitcoinpenguins-claim.com to DNS‑based deny lists and block HTTP traffic to the associated IP address. Monitoring of Cloudflare‑originated IP ranges for similar short‑lived domains is advised. Organizations that rely on CoinMarketCap should reinforce user awareness about unsolicited requests for wallet seeds and advise verification of URLs against the official coinmarketcap.com domain. Continuous retraining of URL filtering solutions to incorporate newly observed impersonation patterns will reduce exposure to variants of this campaign.