pfpepe[.]net

This domain, pfpepe.net, is flagged as a brand impersonation threat specifically targeting dexscreener, a cryptocurrency analytics platform. The site presents itself under the title "Pumpfun Pepe ($PFP) - The Normie Starter," likely designed to deceive users into interacting with fraudulent token or smart contract offers. Analysis indicates no direct evidence of a crypto drainer kit, but the domain’s structure and branding suggest an intent to mislead victims into disclosing wallet credentials or approving malicious transactions under false pretenses.

Infrastructure analysis reveals the following technical indicators: the domain resolves to the IPv6 address 2a06:98c1:3121::3 and was registered on October 04, 2025, through NiceNIC International Group Co., Limited. VirusTotal detection shows 3 out of 95 security vendors flagging the domain as malicious. The domain appears on two security blocklists and is currently offline, though it was previously accessible. No Google Safe Browsing (GSB) entries were identified at the time of assessment, but AlienVault OTX lists it in one threat intelligence pulse, corroborating its malicious classification.

Current status indicates the domain has been taken offline, likely due to enforcement actions or hosting provider intervention. However, residual risk remains elevated as the infrastructure may be reactivated or repurposed under a different domain. Users who interacted with the site should revoke any smart contract approvals, monitor wallet activity for unauthorized transactions, and verify the legitimacy of any linked projects. Organizations should update blocklists to include this domain and its associated indicators to prevent future exposure.