pepenode[.]shop

Analysis of pepenode.shop indicates a brand impersonation campaign targeting Google, classified as a tech support scam. The domain was registered on February 21, 2026, and has since been flagged by multiple security vendors and blocklists. As of July 22, 2026, the domain resolves to 142.250.185.196, an IP address associated with AS15169 (Google LLC), though this hosting arrangement does not confirm legitimacy. The domain's SSL certificate is issued by WE1, a provider commonly used in both legitimate and malicious infrastructure.

Gridinsoft assigns a trust score of 0/100, reflecting high-risk classification. The page title 'Google' aligns with the impersonation target, though no further content analysis is available to confirm specific scam mechanics beyond the tech support classification. Defenders should note that the domain appears on five security blocklists and is actively blocked by PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura. While VirusTotal reports two detections out of 93 vendors, this partial flagging suggests some security tools have identified malicious indicators, though the domain is not universally recognized as harmful.

The domain is currently offline, which may indicate takedown or temporary suspension, but historical resolution and registration data remain valid for retrospective detection. Organizations are advised to block the domain and IP at perimeter defenses and monitor for related infrastructure reuse. No additional scam kit or payload details are available at this time.