claim-pepeheimerpehem[.]xyz

The domain claim-pepeheimerpehem.xyz was registered through NiceNIC International Group Co., Limited on February 21, 2026 and is delegated to the Cloudflare nameservers matt.ns.cloudflare.com and nancy.ns.cloudflare.com. DNS resolution points to the address 188.114.97.3, an IP owned by AS13335 Cloudflare, Inc. in the United States. The site presents a TLS certificate issued by Let’s Encrypt (E8 identifier) and enforces HTTP Strict Transport Security. Additional HTTP headers indicate the use of Cloudflare Browser Insights and the HTTP/3 protocol, confirming that the infrastructure is fully hosted behind Cloudflare’s edge network.

A VirusTotal scan recorded the domain as malicious in five of ninety-five scanning engines, and the domain is listed on a single security blocklist. PhishDestroy has actively blocked the domain, and the current operational status is reported as offline, suggesting that the site is no longer serving content at the time of this analysis. The page title returned from the web server is "Just a moment...", which provides no further insight into the content or intent of the site. Classification from the available intelligence tags the activity as a Crypto Scam, specifically a crypto drainer, indicating that the domain was likely used to solicit cryptocurrency payments or to redirect victims to malicious wallets.

No public evidence of payloads, wallet addresses, or phishing forms has been disclosed, leaving the precise attack vector uncertain. Defenders should add claim-pepeheimerpehem.xyz and its resolving IP 188.114.97.3 to blocklists, monitor for any re‑registration or resurrection of the domain, and consider applying network‑level controls to prevent traffic to Cloudflare‑hosted assets that exhibit the same naming patterns. Continuous observation of NiceNIC‑registered domains and Cloudflare nameservers for similar anomalies is recommended to mitigate future crypto‑drainer campaigns.