papeoneth[.]netlify[.]app

The domain papeoneth.netlify.app was registered on February 21, 2026 through Name.com, Inc. using Netlify’s provisioning services. It resolves to the IPv6 address 2a05:d014:58f:6200::259, which is hosted within Amazon’s AS16509 network and geolocated to Germany. The site presents a DigiCert Global G2 TLS RSA SHA256 2020 CA1 certificate, indicating a valid SSL chain issued by DigiCert Inc. HTTP requests return a 404 status, and the only visible page title reported is "PAPE SWAP". Automated reconnaissance identified Netlify, HSTS, and DigiCert as the underlying technologies.

The domain is currently listed as offline, and both PhishDestroy and ScamSniffer have added it to their blocklists, contributing to its presence on two security blocklists. VirusTotal analysis shows that three of ninety‑three scanning engines flagged the domain, reinforcing the suspicion of malicious activity. The threat classification provided is a crypto scam, and the risk level is elevated.

While the exact content of the landing page has not been captured, the combination of a recent registration, hosting on a cloud provider, a valid SSL certificate, and detection by multiple anti‑phishing services aligns with typical infrastructure used for fraudulent cryptocurrency schemes. Defenders should immediately block the domain at perimeter defenses, add it to internal URL filtering lists, and continue monitoring for any resurrection or related infrastructure. Given the association with known phishing blocklists and the observed crypto‑scam label, any attempts to contact users through this domain should be treated as abusive and reported to appropriate takedown channels.