purplepenny[.]fun

Analysis of the domain purplepenny.fun indicates a cryptocurrency‑focused impersonation campaign targeting Discord users. The site, which was taken offline before the report date, resolves to IP address 185.246.188.31 hosted in the Netherlands under autonomous system AS200651 operated by FlokiNET ehf. The domain is served by four FlokiNET nameservers (ns1.flokinet.net through ns4.flokinet.net) and does not present an SSL certificate, exposing any HTTP traffic to interception. Registration details show the domain was created on 22 August 2025 through the HOSTINGER operations, UAB registrar.

The page title returned by the server reads "Purple Penny ($PPENNY) – Solana Meme Coin," confirming the presence of a Solana meme‑coin narrative, while the threat type is classified as a crypto scam that impersonates Discord. Detection services have flagged the domain: two of ninety‑five VirusTotal scanners raised alerts, and the domain appears on two external blocklists. Both PhishDestroy and ScamSniffer have listed the domain as malicious, reinforcing its reputation as a fraudulent resource. Defenders should immediately block the domain and its associated IP address at perimeter firewalls and DNS filtering solutions.

Monitoring of the FlokiNET nameserver range is advised, as additional malicious domains may be provisioned on the same infrastructure. Email security gateways should be updated to reject any messages containing links to purplepenny.fun or references to the $PPENNY token. Continuous threat‑intel feeds should be consulted for new indicators of compromise linked to the identified ASN or hosting provider, and any observed traffic to the domain should be logged for forensic review.