Is claim-your-pengu-wkyq.vercel.app a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website is a single-page "claim" landing page published under the title "Claim Your $PENGU | Pudgy Penguins". It runs on a free, auto-generated subdomain of the Vercel hosting platform and has no domain of its own. It presents itself as a token-claim or airdrop destination tied to the Pudgy Penguins brand and the PENGU token. Its apparent purpose is to draw visitors into claiming a crypto-asset reward, a format widely used for credential and wallet-harvesting lures.

Scam/Impersonation Risk

Several leading security vendors independently flag this site as malicious, and it has been placed on a confirmed blacklist. The detections are numerous and strong enough to trigger a hard reputational cap, and they are decisive regardless of how clean the surface technical posture appears. The framing aggravates this: the page borrows a well-known NFT brand's name and a token-claim hook ("Claim Your $PENGU"), yet it sits on a disposable hosting subdomain whose hostname merely imitates the claim narrative. Nothing in the evidence connects the site to the genuine brand's official properties. Separately, a large volume of abuse reports exists against the hosting address. These are discounted because the address belongs to a shared platform provider and the reports cannot be attributed to this site, so they are not counted as site-specific evidence. In sandbox testing, the page made no external requests, triggered no wallet-connection or wallet-draining routines, and showed no cloaking or clipboard manipulation. This is a mitigating observation about the behavior captured during the test only, and it does not offset the blacklist. A malicious payload can be swapped in later, or be served only to selected visitors. Evidence:

• Homepage: the page title combines the "$PENGU" token claim with the "Pudgy Penguins" brand name, and the analysed content is about 1,868 characters of text.
• Threat intelligence: 14 malicious and 1 suspicious verdicts were returned, including from three tier-one security vendors.
• Hosting address: 87 abuse reports were recorded against a shared provider address, treated as discounted shared-infrastructure noise.
• Sandbox: 3 of 3 runs completed with zero external network activity, zero wallet-related behavior and 3 console errors.

Regulatory Verification Notes

The analysed homepage shows no licence, registration number, legal entity name or operator identity. No legal or identity pages were captured, so no operator can be independently connected to the site or to the brand it invokes. A token-claim site that handles digital assets would ordinarily be expected to disclose an accountable entity. No third-party broker or regulatory-registry match exists for this site, and the absence of one is not itself evidence of wrongdoing. The decisive risk here is the confirmed threat listing described above, not any licensing gap. The site's transport encryption is valid but is only basic domain-validated encryption. It confirms an encrypted connection and says nothing about who operates the site. Evidence:

• Homepage: no company name, licence, registry reference or contact identity appears in the captured content.
• Transport encryption: the TLS certificate was issued by WR1 at domain-validation (DV) level and is valid to 2026-11-27, with 31 days remaining.
• Hosting: the site is served from AS16509 (AMAZON-02 - Amazon.com, Inc., US), with the origin in the United States.

What to Verify Next

No interaction with the site is advised until the threat listings are cleared. Anyone who believes a genuine PENGU or Pudgy Penguins claim exists should locate it only through the brand's officially announced channels, reached independently of this page, such as the project's verified social accounts or official website typed in manually. Any token-claim announcement should be cross-checked against those channels, and the claim page's hostname should be compared character by character with the officially published address. Any wallet that has already interacted with this site should have its token approvals reviewed and revoked. Users who entered credentials or seed phrases should treat those credentials as exposed and rotate them from a clean device. Official support or contact channels should be confirmed only through the genuine brand's own communications. Evidence:

• Homepage: the claim framing and brand name offer no verifiable link to an official project property.
• Threat intelligence: the active listings are recent and unresolved, so no clean re-scan exists to rely on.
• Sandbox: no wallet interaction was observed in testing, so any exposure would arise only from later or targeted behavior.

Summary Verdict

The site carries an elevated risk posture and is assessed as untrustworthy for any sensitive interaction. Confirmed adverse security-community findings, combined with a brand-themed token-claim lure on a disposable address and no verifiable operator, outweigh the benign sandbox behavior and the valid encryption. Legitimacy is not supported, and the site's real-world operator remains unconnected to the brand it invokes.

Infrastructure Integrity

The site is delivered through Vercel's platform, running on Amazon cloud infrastructure behind a mainstream CDN/WAF layer. All observed addresses are provider edge nodes, and the origin server was not visible. This is a mitigating factor only, because the provider is reputable and the infrastructure is stable. It does not vouch for the content hosted on it. Edge-only visibility also prevents independent verification of the underlying host and can mask a rapid content swap behind an unchanged address.

Closing Assessment

Treat the site as unsafe for any login, credential entry, wallet connection or financial action, and limit contact to read-only viewing from an isolated environment, if at all. Anyone who has already engaged with it should revoke wallet approvals and rotate credentials promptly.

Signals weighed against the site

• AbuseIPDB: 87 reports on hosting IP 216.198.79.3 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.