vesting-pepeheimer[.]live

This domain, vesting-pepeheimer.live, is flagged as a generic phishing threat targeting cryptocurrency users. Analysis indicates it likely impersonates legitimate crypto vesting or staking portals, attempting to harvest wallet credentials or private keys. The domain’s infrastructure and naming convention suggest an intent to deceive users into believing they are interacting with a trusted vesting service, potentially leading to unauthorized fund transfers or account takeovers.

Infrastructure analysis reveals the domain was registered on March 02, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with malicious activity. It resolves to the IP address 188.114.96.3 and is detected by 3 out of 95 security vendors on VirusTotal. The domain appears on one security blocklist and employs technologies such as HSTS, Cloudflare, and HTTP/3, which are often leveraged to obfuscate malicious intent. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites due to its accessibility.

Users who visited vesting-pepeheimer.live should immediately revoke any connected wallet authorizations and monitor their accounts for unauthorized transactions. If credentials or private keys were entered, affected wallets should be considered compromised, and funds should be transferred to a new, secure wallet. Additionally, users are advised to review their browser extensions and device for malware, as phishing sites may deploy additional payloads. No further interaction with the domain should occur, and any cached data related to the site should be cleared from browsers or applications.