pippin-2025[.]fun

This domain, pippin-2025.fun, is identified as a cryptocurrency phishing site designed to deceive users into disclosing wallet credentials or transferring digital assets under false pretenses. The page title 'Nur einen Moment…' suggests an attempt to mimic legitimate authentication or loading processes, a common tactic in credential harvesting campaigns targeting cryptocurrency holders. Analysis indicates the domain was likely engineered to exploit users expecting wallet verification prompts, decentralized application (dApp) interactions, or token airdrop confirmations. Infrastructure analysis reveals multiple technical indicators of malicious intent. The domain was registered on December 28, 2024, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.96.3, which has been linked to other phishing infrastructure. Detection metrics further corroborate its malicious classification: VirusTotal reports 3 out of 95 security vendors flagging the domain, while it appears on three distinct security blocklists. Additionally, the domain is referenced in one AlienVault OTX threat intelligence pulse, indicating active tracking by the security community. Users who visited pippin-2025.fun should take immediate remedial action. If any credentials, seed phrases, or wallet addresses were entered, assume compromise and transfer remaining assets to a new, secure wallet. Monitor connected accounts for unauthorized transactions and revoke any suspicious dApp permissions. It is also recommended to scan local devices for malware, as phishing sites may deploy secondary payloads. Given the domain’s elevated risk classification and offline status, users should remain vigilant for similar threats, particularly those impersonating cryptocurrency services or authentication workflows.