pepeunchainedrevs[.]pages[.]dev

The domain pepeunchainedrevs.pages.dev was identified as a brand impersonation threat specifically targeting Ethereum, a major cryptocurrency platform. Analysis confirms the domain hosted a fraudulent webpage titled 'Pepe Unchained | Pepe’s Own Layer 2 Blockchain,' designed to deceive users into engaging with a counterfeit blockchain service. As of the latest assessment, the domain has been taken offline, though prior activity indicates elevated risk to users exposed during its operational period. Technical indicators reveal the domain was registered on December 14, 2024, through Cloudflare, Inc., and resolved to the IP address 188.114.97.3, associated with Cloudflare’s autonomous system (AS13335). Detection metrics show the domain was flagged by 14 of 95 security vendors on VirusTotal, while a single blocklist, PhishDestroy, had previously listed it. The SSL certificate was issued by Google Trust Services under the identifier WE1, a common provider for both legitimate and malicious domains. Infrastructure analysis further confirms the domain’s hosting location as the United States, with no additional subdomains or redirects observed during its active phase. Current status indicates the domain is offline, reducing immediate exposure risks. However, the technical indicators—including the low detection count on blocklists and the use of a reputable registrar—suggest the campaign may have evaded broader scrutiny. Users who interacted with the domain are advised to revoke any connected wallet permissions, monitor accounts for unauthorized transactions, and verify the legitimacy of any blockchain-related communications. Organizations should update detection rules to include the domain, IP, and associated SSL certificate in threat intelligence feeds to prevent future exposure.