claim-pengu[.]trade

The domain claim-pengu.trade is identified as a crypto drainer, a type of threat designed to redirect cryptocurrency transactions to malicious wallets. The domain does not appear to be associated with any well-known brand, but it is actively used in crypto-draining campaigns. The infrastructure analysis suggests that the domain is part of a broader attack strategy aimed at compromising users' cryptocurrency assets.

Technical indicators reveal that the domain claim-pengu.trade has a VirusTotal score of 3/95, indicating that it is flagged by a small number of security vendors, which may suggest a relatively low but significant level of suspicion. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 188.114.97.3. It was created on May 15, 2026, and is listed on 3 security blocklists. The domain is also mentioned in 1 threat intelligence pulse on AlienVault OTX, further corroborating its malicious nature. The SSL certificate is issued by Let's Encrypt, which is a common practice for legitimate sites but does not guarantee the domain's safety.

As of the current assessment, the domain claim-pengu.trade remains active and poses a high risk to users. Immediate response actions include blocking the domain in network security configurations and warning users to avoid any interactions with the site. Despite the domain being flagged by a minority of security vendors, the presence on multiple blocklists and its active status indicate that it continues to be a threat. Users should remain vigilant and avoid clicking on links or providing any sensitive information, including cryptocurrency wallet details, to this domain to mitigate the risk of asset theft.