claims-pnutsol[.]com

This domain, claims-pnutsol.com, is identified as a crypto drainer, a threat type designed to siphon cryptocurrency assets by executing unauthorized transactions from compromised wallets. The domain impersonates the $PNUT token, a known cryptocurrency project, to deceive users into interacting with malicious smart contracts or phishing interfaces. As of the latest analysis, the domain is offline, though prior activity suggests it was actively targeting users until recently. Infrastructure analysis reveals the domain was registered on July 21, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com. It holds a Gridinsoft trust score of 0/100, indicating high malicious confidence. VirusTotal reports that 1 of 95 security vendors flagged the domain as malicious. The domain appears on two security blocklists and is explicitly blocked by PhishDestroy and ScamSniffer. No associated IP addresses or hosting providers were provided in the available data, but the registration details and blocklist inclusion further corroborate its malicious intent. The domain is currently offline, reducing immediate risk to users. However, historical activity and infrastructure indicators suggest it may resurface under a different domain or hosting arrangement. Organizations and individuals are advised to block the domain at the network level and monitor for related indicators, such as the unique seed b5fb69, which may reappear in future campaigns. Users who interacted with the domain should revoke any connected wallet permissions and audit transaction histories for unauthorized activity. Security teams should update detection rules to include this domain and its associated indicators in threat intelligence feeds.