claimed-pengu[.]app

Analysis of claimed-pengu.app indicates an active crypto drainer phishing domain targeting users through a fake airdrop scam. The domain was registered on April 4, 2026, via NICENIC INTERNATIONAL GROUP CO., LIMITED, and remains operational as of July 12, 2026. Infrastructure analysis reveals Cloudflare-hosted nameservers (erin.ns.cloudflare.com, memphis.ns.cloudflare.com) and an IP resolution to 188.114.96.3, located in Canada under Cloudflare, Inc. The SSL certificate is issued by Let's Encrypt (YE2), a common choice for both legitimate and malicious domains. The domain is flagged on three security blocklists and appears in 22 threat intelligence pulses on AlienVault OTX, confirming its classification as a malicious entity. While only 2 of 94 security vendors on VirusTotal currently detect the domain, this limited detection does not indicate safety, as scanning coverage may be incomplete or delayed. The HTTP status returns a 403 Forbidden response, and the page title 'Just a moment...' suggests Cloudflare protection or a placeholder, which is consistent with phishing infrastructure attempting to evade automated analysis. Defenders should treat this domain as high-risk due to its confirmed crypto drainer activity, fake airdrop classification, and inclusion on multiple blocklists. Network-level blocking is recommended, particularly for organizations handling cryptocurrency transactions or user wallets. Further monitoring of associated IPs, certificates, and registrant details may reveal additional linked infrastructure. The exact content of the phishing page remains unanalyzed, but the domain's intent is clear based on existing intelligence.