mail[.]pepe-unchained[.]xyz

mail.pepe-unchained.xyz was observed returning an HTTP 403 error page when accessed, indicating that the web server is configured to deny requests. The domain lacks an SSL certificate, which eliminates encrypted communication and is typical for many low‑quality phishing infrastructures. Registration data shows the domain was created on 17 November 2025 through NiceNIC International Group Co., Limited, and it is served by HostGator name servers hgns1.hostgator.com and hgns2.hostgator.com. The sole A record resolves to 50.6.19.105, an address owned by AS31898, Oracle Corporation, located in the United States.

Reputation signals are strongly negative: the site appears on one security blocklist, has a Gridinsoft trust score of 0 / 100, and is listed by PhishDestroy as blocked. VirusTotal scans have flagged the domain in 10 of 95 antivirus engines, reinforcing the malicious assessment. The combination of a recent registration, lack of TLS, a generic 403 response, and multiple independent detections suggests the domain is being used for phishing operations, although the specific credential‑harvesting page has not been captured.

Analysts should continue to monitor DNS resolution for changes, enforce blocking at perimeter firewalls, and add the domain to internal deny lists. Because the site is currently offline, any active campaigns may be dormant, but the infrastructure could be repurposed for future attacks. Further investigation, such as acquisition of historic HTTP content via web archives, could clarify the exact phishing template used.