Is claim-your-pengu-5.vercel.app a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page "claim" landing page, published as a free subdomain on a developer hosting platform. Its title reads "Claim Your $PENGU | Pudgy Penguins." It presents itself as a token-claim portal tied to the Pudgy Penguins brand and the $PENGU token. Its apparent purpose is to draw visitors into a claim or airdrop-style interaction under a well-known NFT and token brand name.

Scam/Impersonation Risk

Multiple independent security engines currently flag this site as malicious, including several tier-one vendors. That is a confirmed blacklist condition. It is the decisive factor in this assessment and is not offset by any technical hygiene. The site's structure fits a recognizable abuse pattern. A throwaway, numbered hostname ("claim-your-pengu-5") on a shared hosting platform borrows a popular brand's name and token ticker. It uses the urgency of a "claim" to prompt a visitor to act. The numeric suffix suggests one of several parallel copies, which is typical of campaigns that rotate pages as they are reported. The domain also closely resembles the hosting platform's own registrable domain, which is how lookalike hostnames gain false credibility. No independent evidence ties this page to the brand it names. Abuse reports recorded against a shared platform address were discounted because they apply to the provider's shared infrastructure, not to this site specifically, so they carry no weight in the conclusion. Behaviourally, the page made no external network calls and showed no wallet-connection, clipboard-manipulation or hidden-form activity during sandbox runs. That is mildly reassuring about the page as captured, but it does not offset the multi-engine malicious detections. A claim-lure page can look inert until a later step, or after a content swap. No conflicting legal-entity names were found, because the page discloses no entity at all. Evidence:

• Homepage: the title presents a "$PENGU" claim under the Pudgy Penguins name, while the page sits on a generic platform-issued subdomain rather than a brand-controlled domain.
• Reputation checks: several tier-one security engines classify the site as malicious, and an external blacklist condition is active.
• Shared-address abuse reports (87 in total) were attributed to the platform provider's shared address and discounted.
• Sandbox behaviour (3 of 3 runs successful): zero external requests, no wallet-provider detection and no cloaking observed.

Regulatory Verification Notes

The site is a single landing page with no visible legal, terms, about or licensing content that would identify an operating entity, so ownership remains opaque. No independent evidence connects the site to Pudgy Penguins or to any token issuer. Any on-page branding therefore cannot be treated as proof of affiliation. No broker or regulatory-database match exists for this domain. That absence is neutral, not a clearance. A token-claim mechanism on an anonymous page falls outside any recognizable licensed-service framework. Evidence:

• Homepage: no identifiable legal entity, contact route, terms or disclosure of who operates the claim.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• Transport encryption: TLS certificate issued by WR1 (DV, domain validation only), valid to 2026-11-27. This confirms an encrypted connection and says nothing about the operator's identity.

What to Verify Next

Any claim or distribution tied to the $PENGU token should be confirmed only through channels reached independently of this page. Examples are the official Pudgy Penguins website typed in manually and its verified social accounts. If those channels do not announce this claim, the page should be treated as unauthorised. Anyone who has already interacted with the page should review wallet approvals and revoke any unfamiliar permissions. Where possible, report the page to the hosting platform's abuse channel and to the brand's security contact, so the page can be taken down. Evidence:

• Homepage: the claim relies on the brand name and token ticker, so only official brand announcements can validate it.
• Domain structure: the numbered hostname suggests sibling pages may exist, so other similarly named addresses should be treated with the same suspicion.

Summary Verdict

The overall posture is high risk. Multiple independent threat detections, a brand-themed claim lure and an unidentified operator converge on a clearly adverse conclusion. The page's clean sandbox behaviour and valid encryption do not change it. The site is unsuitable for login, credential entry, wallet interaction or any financial action.

Infrastructure Integrity

The site is delivered through a trusted CDN/WAF platform on Amazon-hosted address space, and all observed addresses are edge servers. The origin server was not observable, so the hosting arrangement cannot be independently verified. Edge-only visibility can also mask rapid content swaps. The protection and the valid certificate are mitigating factors only. They do not offset the external threat detections.

Closing Assessment

Treat the page as read-only content at most. Do not connect a wallet, sign any transaction or message, or enter a seed phrase or credentials. Pursue any genuine token entitlement only through the brand's officially published channels.

Signals weighed against the site

• AbuseIPDB: 87 reports on hosting IP 216.198.79.3 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.