pepeunchained-claim[.]pages[.]dev

The domain pepeunchained-claim.pages.dev was observed on July 29, 2026 as an active crypto drainer infrastructure. VirusTotal records indicate that thirteen of ninety‑one scanning engines have generated a detection for the domain, demonstrating that a subset of security products recognize malicious behavior associated with it. The domain is hosted on Cloudflare’s network, as evidenced by its registration with Cloudflare, Inc. and the use of Cloudflare’s authoritative name servers gwen.ns.cloudflare.com and hugh.ns.cloudflare.com. DNS resolution points to the address 188.114.97.3, a Cloudflare edge node that is commonly leveraged for fast content delivery and, in malicious campaigns, for obscuring the true origin of traffic.

Defensive feeds have already marked the domain as hostile. PhishDestroy has added it to its blocklist, and it appears on one additional external security blocklist, reinforcing its reputation as a threat. The limited number of public detections suggests that the campaign may be in an early deployment stage or that it relies on evasion techniques that bypass many scanners. No public SSL certificate details, HTTP response codes, or page title information are currently available, leaving the exact delivery mechanism and content of the phishing page unverified.

Given the confirmed association with a crypto drainer operation, security teams should block DNS resolution for the domain and its associated IP address at network perimeters. Endpoint protection solutions should be updated to incorporate the thirteen VirusTotal detections, and threat‑intelligence platforms should ingest the domain’s indicators of compromise. Continuous monitoring of Cloudflare‑hosted assets and periodic re‑scans are recommended, as the infrastructure may evolve or expand to additional IP ranges. Until further forensic analysis of the hosted content is possible, the domain should be treated as malicious and excluded from any legitimate traffic.