pepeto-claiming[.]io

PepeTo-claiming.io is a malicious domain identified as a crypto drainer, specifically designed to steal cryptocurrency from users by impersonating a legitimate memecoin project. The domain is currently offline, but its infrastructure and threat indicators suggest a sophisticated phishing campaign targeting investors in the PEPETO token and related multi-memecoin exchange presales.

PhishDestroy's investigation reveals that this domain was flagged by 11 of 95 VirusTotal security vendors, confirming its malicious nature. The domain resolves to IP address 213.165.61.42 and was registered through NiceNIC International Group Co., Limited on October 25, 2025. It appears on 5 security blocklists, and its SSL certificate is issued to localhost, a clear red flag indicating no legitimate encryption. The page title claimed to be "PEPETO Token– The Ultimate Memecoin Revolution | Presale for Multi-Memecoin Exchange," which is a direct impersonation of a legitimate crypto project to lure victims.

Given that the domain is now offline, the immediate risk of active phishing is reduced. However, PhishDestroy strongly recommends that users who may have interacted with the site—especially those who entered wallet credentials or approved transactions—should revoke permissions and transfer assets to new wallets immediately. Organizations should add this domain to their blocklists and monitor for similar domains using the seed d497fb. Eternal vigilance is necessary as these drainers often reappear under new domains. The crypto community should be warned about this specific threat to prevent future losses.