airdrop[.]realpepecoin[.]io

The domain airdrop.realpepecoin.io is currently classified as a high‑risk brand‑impersonation site targeting Telegram users. The page title “Real Pepe Coin – Airdrop” and the listed scam type of cryptocurrency indicate that the operator is attempting to lure victims with a promised airdrop, while masquerading as an official Telegram communication. The threat is active as of the report date, July 12 2026, and has already been identified on a security blocklist.

Infrastructure analysis shows the domain was registered on 13 January 2025 through NETWORK SOLUTIONS, LLC. It is protected by a Let’s Encrypt certificate (R13) and resolves to the IP address 192.254.226.105, which belongs to AS46606 Unified Layer in the United States. The hosting environment runs Apache HTTP Server and serves content built with the Bootstrap framework. Authoritative nameservers are hgns1.hostgator.com and hgns2.hostgator.com, both typical of shared‑hosting services.

Reputation services assign very low trust scores: Gridinsoft rates the site 0 out of 100, and Scamadviser reports a score of 26 out of 100, reflecting the malicious nature of the page. The site matches an “Airdrop Scam” phishing kit, and one of the 95 VirusTotal scanners flagged the domain, confirming malicious activity. It is also listed as blocked by PhishDestroy. No additional public content has been captured, so the exact visual layout and credential‑collection mechanisms remain unverified.

Defenders should treat airdrop.realpepecoin.io as hostile. Immediate actions include adding the domain and its IP address to network deny lists, updating email and web filters to block URLs containing “realpepecoin.io”, and monitoring for related indicators such as other domains using the same nameservers or certificate. Continuous threat‑intel feeds should be consulted for any new detections, and incident response teams should be prepared to investigate any reports of Telegram‑related credential compromise that reference this domain.