pngclaimreward[.]com

pngclaimreward.com was observed in mid‑2026 as part of a crypto‑drainer campaign. The domain was registered on 28 February 2026 through Ultahost, Inc., and uses the provider’s four authoritative name servers (ns1‑ns4.ultahost.com). DNS resolution points to the single IPv4 address 192.142.10.5, which belongs to AS214036 owned by Ultahost, Inc. and is geolocated to the Netherlands. No TLS certificate was presented, indicating the site operated over plain HTTP only.

The page title returned by the server, “Png Claim Chain”, aligns with the reported scam type of a crypto‑scam, and analysis of the underlying code identified the publicly available “Gambler Scam” phishing kit. VirusTotal recorded five positive detections out of ninety‑three scanners, and the domain appears on three independent security blocklists. Defensive products including PhishDestroy, MetaMask and SEAL have already listed the host as malicious, and the operator has taken the site offline as of the report date, 24 July 2026.

While the infrastructure details are concrete, the exact victim‑facing content and any associated wallet addresses remain undisclosed, limiting a full assessment of monetary loss. Defenders should continue to block the domain at network perimeter and DNS layers, monitor the 192.142.10.5 address for any re‑use, and incorporate the observed indicators of compromise—such as the registrar, name‑server set, and page title—into threat‑intel feeds. Ongoing verification of blocklist entries and periodic re‑scanning of the domain, should it become reachable again, are recommended to maintain coverage against potential re‑activation.