henrythepenguin[.]live

On 24 July 2026, the domain henrythepenguin.live was observed hosting a site whose page title reads “$HENRY — The World's Tiniest Penguin Memecoin”. The domain was registered on 22 February 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare‑owned address 188.114.96.3, AS13335 in the United States. DNS resolution is delegated to lilyana.ns.cloudflare.com and kyle.ns.cloudflare.com, and the site serves content over HTTPS using a Let’s Encrypt E8 certificate. HTTP requests receive a 301 redirect, and the server advertises HTTP/3 support, confirming the use of Cloudflare’s edge infrastructure. Reputation services flag the domain as high‑risk. Gridinsoft assigns a trust score of 0 out of 100.

VirusTotal reports that 3 of 95 scanned scanners flag the domain, and the host appears on four independent security blocklists. Additional defensive feeds—PhishDestroy, MetaMask, ScamSniffer, and SEAL—have listed the domain as blocked. The page title suggests the site is masquerading as a cryptocurrency token named $HENRY, a typical lure for crypto‑focused phishing campaigns. Evidence indicates an active phishing infrastructure, but the exact payload, credential‑stealing mechanisms, or malicious redirects have not been publicly disclosed. No detailed analysis of the landing page content is available beyond the title.

Consequently, the precise tactics employed by the actors remain uncertain. Defenders should block outbound connections to 188.114.96.3 and add henrythepenguin.live to URL filtering policies. Monitoring for DNS queries to the associated Cloudflare nameservers can provide early detection of infection attempts. Users should be warned that any unsolicited communications referencing $HENRY or offering related investment opportunities are likely fraudulent. Continuous re‑evaluation is advised as additional indicators may emerge.