pepeunchained-claimweb[.]pages[.]dev

PhishDestroy identifies pepeunchained-claimweb.pages.dev as an active crypto drainer domain currently distributing malicious wallet-draining scripts. The site masquerades as a legitimate PepeUnchained token-claim interface, tricking users into connecting their wallets and signing malicious transactions that silently transfer tokens to attacker-controlled addresses. The threat actor is utilizing a lightweight drainer kit optimized for speed and evasion, likely forked from an open-source template and customized with PepeUnchained branding to enhance credibility among crypto enthusiasts.

This domain was flagged by 18 out of 95 VirusTotal security vendors and is hosted on Cloudflare Pages, resolving to IP 188.114.97.3 with a Google Trust Services SSL certificate. PhishDestroy data shows it is a newly observed domain with no publicly listed creation date, yet it has already been added to one known blocklist and flagged by ScamSniffer. The combination of high VT detection rate, Cloudflare hosting, and recent emergence suggests a rapidly deployed campaign leveraging free hosting to evade takedowns.

As of today, pepeunchained-claimweb.pages.dev remains active and accessible. PhishDestroy continues to monitor and block this domain in real time. Users are strongly advised to verify any PepeUnchained-related link via PhishDestroy before entering credentials or connecting wallets. While the immediate threat is contained through active blocking, the risk remains elevated due to the domain's active status and the likelihood of continued evolution by the threat actor.