pudgypngutracker[.]xyz

On 30 July 2026 the domain pudgypngutracker.xyz was registered through Global Domain Group LLC. The domain uses Cloudflare DNS (dane.ns.cloudflare.com, nena.ns.cloudflare.com) and resolves to the IP address 188.114.97.3. VirusTotal reports that three of ninety‑one scanning engines flagged the domain as malicious, indicating a modest but non‑trivial detection rate. The same address appears on three public security blocklists and is listed in a single AlienVault OTX pulse, suggesting that threat‑intel communities have begun to surface the infrastructure. Additional defensive services, including PhishDestroy, MetaMask and SEAL, have independently blocked the domain, reinforcing the view that it is being used for malicious purposes.

The short time between registration (30 July 2026) and the first public detections (as of the 3 August 2026 report) points to a rapid deployment typical of generic phishing campaigns. The lack of publicly available page content, SSL certificate details, HTTP response codes, or a known targeted brand limits the depth of technical attribution. The hosting environment behind Cloudflare obscures the origin server, and no further infrastructure components such as additional sub‑domains, C2 servers, or malware payloads have been disclosed. Given the available evidence, the domain should be treated as an active high‑risk phishing vector.

Defenders should add pudgypngutracker.xyz to network and endpoint blocklists, enforce DNS filtering, and monitor for outbound connections to 188.114.97.3. Continuous re‑scanning on VirusTotal and other sandbox services is advised to capture any evolving payloads. Organizations should also review recent user reports for unsolicited communications that reference the domain, and educate end users on the presence of this newly observed malicious site.