claim-pepeheimer[.]live

Analysis indicates that the domain claim-pepeheimer.live was registered on 27 February 2026 through NiceNIC International Group Co., Limited. The domain resolves to 172.67.180.118, an address owned by Cloudflare (AS13335) located in the United States. Both authoritative nameservers, marlowe.ns.cloudflare.com and matias.ns.cloudflare.com, are Cloudflare‑provided, confirming that the infrastructure is hosted behind Cloudflare’s network. No TLS certificate is presented; the HTTPS handshake fails, which is consistent with the reported offline status. The site returned the HTTP title “Just a moment…”, a generic placeholder often used in automated redirects or challenge pages, but no further content has been captured.

Gridinsoft assigned a trust score of 0 / 100, indicating an extremely low reputation. The domain appears on three external blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL, suggesting that security products have identified it as malicious. VirusTotal scans show that eight of ninety‑three AV engines flagged the domain, reinforcing the suspicion. The listed scam type is “Crypto Scam”, specifically a crypto drainer, which aligns with the blocking by MetaMask, a wallet extension often targeted by such campaigns. However, the absence of a valid SSL certificate and the offline status limit the ability to observe any payload or phishing page.

Consequently, the exact tactics, such as whether the site attempted to harvest private keys or redirect transactions, remain uncertain. Defenders should continue to block claim-pepeheimer.live at network perimeter and endpoint layers, update any URL filtering lists, and monitor for related C2 activity originating from the same Cloudflare IP range. Incident response teams should treat any connections to this domain as malicious, quarantine associated traffic, and enforce strict wallet‑extension policies to prevent credential leakage.