airdrop-pepenode[.]io

Analysis indicates that the domain airdrop-pepenode.io was registered on 19 November 2025 through NiceNIC International Group Co., Limited and currently resolves to the Cloudflare‑owned IP 172.67.132.96 (AS13335, United States). The site returns the page title “Un momento…” and responds with an HTTP 403 status code, which suggests the page is deliberately inaccessible to generic browsers while potentially serving malicious payloads to targeted requests. The TLS certificate is issued by Google Trust Services under the WE1 designation, providing a valid certificate chain but not confirming legitimacy. DNS is hosted on Cloudflare (adelaide.ns.cloudflare.com, conrad.ns.cloudflare.com) and the site employs Cloudflare Browser Insights and HTTP/3, a pattern frequently observed in fast‑flux or proxy‑based malicious campaigns. The domain is categorised as a fake‑airdrop crypto drainer; seven of ninety‑five VirusTotal scanners have flagged it, and Gridinsoft assigns a trust score of 0/100. It appears on four external blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—further confirming its malicious reputation. The combination of recent creation, low trust rating, multiple blocklist listings, and the fake‑airdrop narrative aligns with a high‑risk crypto‑draining operation. Defenders should block the domain at DNS and proxy layers, monitor outbound traffic to the associated IP, and treat any credentials or cryptocurrency wallet information submitted to this domain as compromised. The domain remains active as of the report date, warranting continued observation.