pongoexplorer[.]info

PhishDestroy identifies the active domain pongoexplorer.info as hosting a fake login page designed to harvest user credentials and spread a crypto drainer malware. This threat is currently under investigation but remains active, posing a credible risk to visitors who interact with the fraudulent interface. The domain is engineered to mimic legitimate financial platforms, tricking users into submitting sensitive information that is subsequently exfiltrated by attackers for credential theft and cryptocurrency theft.

This domain was flagged by 1 of 95 VirusTotal vendors at the time of analysis, indicating a low detection rate despite clear malicious intent. The domain was registered on April 24, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to IP address 172.67.215.56 and is associated with a Let's Encrypt SSL certificate, which may contribute to a false sense of legitimacy. Currently, the domain has zero entries in known blocklists and maintains low trust scores, highlighting its recent emergence and immature threat intelligence coverage.

Based on available intelligence, PhishDestroy advises users and organizations to avoid accessing pongoexplorer.info. If the site was visited or credentials were entered, users should immediately revoke access, change passwords, and scan devices for malware. Security teams should block the domain at the network level and report indicators to threat intelligence platforms. Continuous monitoring of this domain is recommended due to its evolving nature and low detection coverage.