m-pepeheimer[.]pages[.]dev

PhishDestroy identifies m-pepeheimer.pages.dev as an active identity theft drainers domain masquerading under Pepe-themed branding to lure victims into connecting crypto wallets or entering credentials. The domain uses Cloudflare Pages hosting, which complicates server-side takedowns due to Cloudflare's infrastructure protections. No specific drainer kit metadata is publicly available, but behavioral patterns suggest imitation of Pepe-related services to exploit decentralized finance (DeFi) users. This domain was flagged by PhishDestroy with a generic phishing classification, currently under investigation. VirusTotal analysis shows 0 detections out of 95 engines, indicating low AV coverage despite active malicious behavior. The domain resolves to IP 188.114.97.3, registered through Cloudflare, Inc., and secured with a Google Trust Services SSL certificate. No creation date is publicly available due to Cloudflare Pages masking origin domains, and the domain remains unlisted on major blocklists as of this assessment. m-pepeheimer.pages.dev is actively serving malicious content, as confirmed by real-time telemetry. Cloudflare has not yet responded to takedown requests due to its standard abuse handling process. Users should avoid accessing this domain, especially if encountered via unsolicited links in social media or crypto communities. Remaining risk is HIGH due to lack of AV detection and Cloudflare's hosting resilience. Recommend immediate network-level blocking of 188.114.97.3 and user alerts for any interactions with this domain.