# pippins.network — MALICIOUS — Crypto Drainer (Angel Drainer)

> Pippins.network hosted a crypto drainer scam using Angel Drainer kit. Domain now offline. Stay alert and avoid risky airdrop sites like pippins.network.

## Summary
PhishDestroy identifies pippins.network as a medium-risk crypto drainer domain that targeted users with fraudulent airdrop schemes. This threat is significant as it aimed to steal cryptocurrency assets by tricking victims into interacting with malicious smart contracts or wallet permissions. The use of a drainer kit, specifically Angel Drainer, underscores the automated and dangerous nature of this scam.

The domain pippins.network was registered on December 18, 2025, through NiceNIC International Group Co., Limited and resolved to the IP address 172.67.157.13. It appeared on three security blocklists and was flagged by three out of ninety-five security vendors on VirusTotal, which aligns with its medium threat rating. The domain’s Gridinsoft trust score is 0/100, indicating no credibility. The site, titled "Pippin l Official Airdrop," has since been taken offline, effectively disrupting the scam infrastructure.

Users are strongly advised to avoid interacting with suspicious airdrop offers, especially those hosted on domains flagged for crypto draining activity like pippins.network. Never authorize wallet transactions or connect your crypto wallets to unofficial sites. Always verify airdrop legitimacy through official project channels and use security tools to block known malicious domains. Staying vigilant and informed can prevent losses from similar crypto scams.

## Threat Details
- Verdict: MALICIOUS — Crypto Drainer (Angel Drainer)
- Site status: dead (HTTP 403)
- Drainer type: Angel Drainer
- Scam type: Airdrop Scam
- Kit: Airdrop Scam
- Page title: Pippin l Official Airdrop

## Domain Intelligence
- Registered: 2025-12-18 00:00:00
- Expires: 2026-12-18 00:00:00
- Registrar: NiceNIC International Group Co., Limited
- Country: HK
- IP: 172.67.157.13
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: nucum.ns.cloudflare.com patryk.ns.cloudflare.com
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 3 vendors flagged
  Vendors: ["Ermes", "Gridinsoft", "SOCRadar"]
- Google Safe Browsing: clean
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "MetaMask", "ScamSniffer"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019b3a0b-6315-7184-9d2e-91c5194e9e7f.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/622b4880-e816-415a-8e7f-d4dcaa86f226
- Wayback Machine: https://web.archive.org/web/https://pippins.network
- PhishDestroy: https://phishdestroy.io/domain/pippins.network/
- LLM endpoint: https://phishdestroy.io/domain/pippins.network/llm.txt

## If You Visited This Site
1. Revoke all token approvals immediately (revoke.cash / unrekt.net)
2. Move remaining funds to a new wallet
3. Do not interact with any transactions from this site
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/pippins.network/
Last updated: 2026-03-19