claim-pepe[.]app

The domain claim-pepe.app was registered on March 26, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the Cloudflare‑provided address 172.67.174.153 and uses the authoritative name servers lennox.ns.cloudflare.com and roxy.ns.cloudflare.com. HTTP requests return a 403 response and the page title is limited to the generic “Just a moment…”. The site presents a TLS certificate issued by Let’s Encrypt (subject E8), indicating that encrypted connections are available despite the forbidden status code. Threat intelligence shows the domain appears on one security blocklist and is listed in a single AlienVault OTX pulse. Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal records two detections out of 95 scanned vendors. The blocklist service PhishDestroy currently flags the domain as active, and the overall risk rating is high. The combination of a newly created domain, Cloudflare front‑end, and the “Just a moment…” landing page is consistent with the fake‑airdrop crypto‑drainer campaign observed in early 2026. While the infrastructure details are concrete, the specific payload or wallet addresses used for cryptocurrency draining have not been publicly disclosed. The only actionable indicator is the association with a fake airdrop lure, which typically attempts to harvest private keys or induce users to approve malicious transactions. Absence of observed malicious binaries or network traffic means that detection must rely on domain‑level indicators and behavior heuristics. Defenders should add claim‑pepe.app and its resolved IP 172.67.174.153 to outbound and inbound block lists, enforce TLS inspection to capture the underlying content behind the Cloudflare challenge, and monitor for any outbound requests to known cryptocurrency exchange endpoints from internal hosts. Regular updates to threat feeds that include the blocklist entry and OTX pulse will help maintain coverage as the campaign evolves.