little-claimpepe[.]live

The domain little-claimpepe.live was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is presently taken offline. Infrastructure analysis shows the domain resolves to IP address 172.67.221.49, which belongs to AS13335 Cloudflare, Inc. in the United States and is served behind Cloudflare’s network. The site presents a TLS certificate issued by Google Trust Services under the WE1 intermediate, confirming the use of a valid HTTPS certificate despite the malicious intent. An HTTP request returns a 403 status code, indicating access is denied, and the page title captured before takedown reads "Little Pepe Presale | LILPEPE Token," suggesting an attempt to lure cryptocurrency investors.

The domain is classified as a brand‑impersonation campaign targeting the Ethereum ecosystem, specifically employing wallet or seed‑phishing techniques. Detection data shows three of ninety‑three VirusTotal scanners flag the domain, and Gridinsoft assigns a trust score of zero out of one hundred, reflecting a high likelihood of malicious behavior. The domain appears on two independent security blocklists and is actively blocked by PhishDestroy and ScamSniffer. While the site is no longer reachable, the combination of a low trust score, multiple vendor detections, and explicit blocklist listings provides strong evidence of a phishing operation.

Uncertainties remain around the exact content served and any associated payloads, as the domain is offline and no further forensic capture is available. Defenders should continue to block the domain and its resolving IP, update intrusion‑detection signatures to include the observed HTTPS certificate chain and Cloudflare nameservers, and monitor for newly registered domains that share the "little‑claimpepe" pattern or reference the LILPEPE token. Continuous surveillance of Cloudflare‑hosted IP ranges for similar brand‑impersonation activity is also recommended.