pngclaimhub[.]com

This domain operates as a fraudulent Ethereum airdrop portal under the guise of a PNG token claim hub. Analysis indicates it specifically targets users through deceptive branding of the "Png Claim Chain" initiative, attempting to harvest wallet credentials and private keys by mimicking legitimate token distribution events. The page title "Png Claim Chain" and associated infrastructure suggest a coordinated effort to exploit users expecting legitimate PNG token allocations, a common tactic in cryptocurrency phishing campaigns. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on April 24, 2025, through GRANSY S.R.O D/B/A SUBREG.CZ, with a Let's Encrypt SSL certificate (R13) providing superficial legitimacy. It resolves to 192.142.10.5 (AS214036 Ultahost, Inc., Netherlands), an IP address currently flagged by 14 out of 95 security vendors on VirusTotal. The domain appears on six distinct security blocklists, including cryptocurrency-specific protection systems, confirming its malicious classification. Additional technical indicators include immediate takedown status and blocking by multiple wallet protection mechanisms. Users who interacted with pngclaimhub.com should assume credential compromise. Immediate actions include revoking all connected dApp permissions, transferring assets to a new wallet, and monitoring for unauthorized transactions. The domain's creation date and rapid inclusion on multiple blocklists suggest active exploitation; affected users should check all connected devices for malware. No legitimate token claims require private key or seed phrase submission. Security teams should add the domain, IP 192.142.10.5, and SSL certificate fingerprint to network protection systems to prevent further exposure.