littlepepe-vip[.]ciriu[.]icu

The domain littlepepe-vip.ciriu.icu was registered on February 21, 2026 and is currently taken offline. DNS resolution points to the IPv4 address 163.61.188.5, which is announced by AS153568 NEW DHAKA HARDWARE and geolocated to the United States. The host is associated with a single security blocklist entry and has been flagged by the PhishDestroy service. VirusTotal analysis recorded a single positive detection out of ninety‑three scanning engines, indicating that at least one vendor identified the domain as malicious.

The site presented the page title “Little Pepe Presale | LILPEPE Token,” and the SSL certificate is identified as type R10, suggesting the use of a low‑trust or self‑signed certificate. The campaign is classified as a crypto scam that impersonates the Ethereum brand, targeting users interested in token presales. Evidence confirms that the domain leveraged the Ethereum brand name to lure victims, but the exact content of the landing page has not been publicly captured.

Uncertainty remains regarding the full extent of the phishing kit, any additional command‑and‑control infrastructure, and whether the domain was ever used to harvest credentials. Defenders should continue to block the resolved IP address and add the domain to internal URL filtering lists, monitor for related subdomains or similar naming patterns, and consider sharing the observed indicators with threat‑intel communities. Ongoing observation of the ASN and any re‑hosting activity is recommended to detect potential re‑deployment of the infrastructure.