claim[.]pudgy-allocation[.]com

The domain claim.pudgy-allocation.com was observed resolving to the Cloudflare edge address 172.67.195.150, which is advertised as part of ASN 13335 and is geolocated to the United States. Registration data shows the domain was created on 19 September 2025 and was issued through NiceNIC International Group Co., Limited, with authoritative nameservers cody.ns.cloudflare.com and emerie.ns.cloudflare.com. No TLS certificate was presented during the brief connection attempt, indicating the site was served without HTTPS protection. The page title returned by the HTTP response is “Claim Your $PENGU | Pudgy Penguins”, and the content is classified as a wallet/seed phishing campaign that impersonates the Solana brand.

VirusTotal analysis recorded three positive detections out of ninety‑five scanned engines, and the domain is currently listed on two independent blocklists, PhishDestroy and ScamSniffer, which have both taken the domain offline. The elevated risk rating reflects the combination of credential‑harvesting intent, the use of a reputable hosting provider, and the targeting of cryptocurrency users. At the time of analysis the site was not reachable, limiting the ability to capture additional artefacts such as form fields or payloads.

Consequently, the exact phishing kit and any associated command‑and‑control infrastructure remain unknown. Defenders are advised to block the IP address 172.67.195.150 and the domain name at perimeter filters, monitor for any future re‑registration of the same second‑level domain, and update internal threat‑intel feeds with the observed identifiers, including the registrar, nameservers, and the page title. Continuous observation of Cloudflare‑hosted assets targeting Solana‑related users is recommended to detect potential re‑use of this infrastructure.