pepetotoken[.]xyz

Analysis of www.pepetotoken.xyz shows a newly registered domain (creation date March 22, 2026) that has been associated with a crypto‑related scam. The site resolves to the IP address 64.29.17.65, which is hosted by Vercel, Inc. in the United States and is served through the Vercel platform, as indicated by the detected technology fingerprint. No TLS certificate is presented, confirming the absence of HTTPS protection. The page title returned by the server is "Vercel Security Checkpoint," offering no direct indication of malicious intent but confirming the underlying hosting environment. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reflecting a complete lack of confidence in the domain's legitimacy.

VirusTotal analysis records five detections out of ninety‑four security vendors, providing independent confirmation of malicious behavior. The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the view that it is being used for phishing or fraudulent activity. Registration details list NICENIC INTERNATIONAL GROUP CO., LIMITED as the registrar, and the authoritative name servers are mckenzie.ns.cloudflare.com and seth.ns.cloudflare.com, both Cloudflare‑operated. Current operational status is offline, limiting the ability to capture live content; the only observable artifact is the page title.

Defenders should immediately add www.pepetotoken.xyz to URL filtering and domain blocklists, enforce strict outbound traffic controls to the associated IP 64.29.17.65, and monitor for any future re‑activation. Continuous observation of the hosting provider Vercel for similar patterns is advised, as is periodic re‑scanning of the domain should it come back online. Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms, because the site content has not been captured while offline.