claimpudgypenguins[.]xyz

The domain claimpudgypenguins.xyz was registered on December 19, 2024 through Web Commerce Communications Limited and is currently hosted on Cloudflare infrastructure (IP 172.67.182.75, AS13335, United States). DNS resolution points to Cloudflare nameservers aarav.ns.cloudflare.com and piper.ns.cloudflare.com. No TLS certificate is presented, and an HTTP request returns a 522: Connection timed out page title, indicating the service is presently offline. Threat intelligence classifies the site as a crypto scam employing an Airdrop Scam phishing kit.

Seven of ninety‑five VirusTotal security vendors have flagged the domain, and it appears on a single external blocklist. Additional defensive products have taken action: PhishDestroy lists the domain as blocked, and Gridinsoft assigns a trust score of 0 out of 100, reflecting extreme malicious confidence. The combination of a low trust score, vendor detections, and association with a known airdrop‑drain kit strongly suggests the domain was used to lure cryptocurrency holders into surrendering private keys or sending funds to attacker‑controlled wallets. Because the site is offline, active content cannot be inspected, leaving the exact payload and landing page unknown.

Defenders should continue to block the domain at DNS and proxy layers, monitor outbound connections to the associated IP address, and add the domain to internal blocklists. Ongoing observation of Cloudflare‑hosted IP ranges for similar airdrop‑drain activity is advised, as threat actors often reuse infrastructure. Incident response teams should treat any user‑reported interactions with this domain as compromised and initiate standard crypto‑asset containment procedures.