pengu-api[.]pudgypenguins-dev[.]com

The domain pengu-api.pudgypenguins-dev.com is a generic phishing site posing an elevated risk of credential theft or fraudulent activity. It does not impersonate a specific brand or deploy a known drainer kit. As of the latest verification, the site has been taken offline, but prior activity indicates it was designed to deceive users into submitting sensitive information.

Technical analysis shows pengu-api.pudgypenguins-dev.com was flagged by 2 of 95 VirusTotal security vendors, including ChainPatrol and SOCRadar. It appears on 1 security blocklist (PhishDestroy) but is not flagged by Google Safe Browsing. The domain was registered through Cloudflare, Inc. on March 12, 2026, and resolves to the IP address 66.33.60.194, hosted on Amazon.com, Inc. infrastructure (AS16509) in the US. The SSL certificate is issued by R12, and the observed page title was '$PENGU'. Nameservers are kayleigh.ns.cloudflare.com and sam.ns.cloudflare.com. Gridinsoft assigns a trust score of 0/100 to this domain.

Users who interacted with pengu-api.pudgypenguins-dev.com should immediately change any passwords or credentials entered on the site and enable two-factor authentication on affected accounts. Monitor financial and personal accounts for unauthorized activity. Report the domain to anti-phishing organizations such as PhishTank or the Anti-Phishing Working Group (APWG). If cryptocurrency transactions were involved, revoke any token approvals and consider moving funds to a new wallet. Victims may also report the incident to local cybercrime authorities or platforms like the FBI’s Internet Crime Complaint Center (IC3).