1ittlepepe[.]com

Analysis of 1ittlepepe.com indicates an active cryptocurrency phishing domain targeting users through a fraudulent token presale. The domain, registered on August 5, 2025, via Key-Systems GmbH, resolves to IP 104.21.16.1 (AS13335, Cloudflare, Inc., US) and is fronted by Cloudflare nameservers igor.ns.cloudflare.com and june.ns.cloudflare.com. The page title, 'Little Pepe Presale | LILPEPE Token,' explicitly advertises a cryptocurrency offering, aligning with the scam type classification. Infrastructure analysis reveals the use of Cloudflare services and HTTP/3, common in phishing campaigns to obscure origin servers and evade detection. The domain is flagged by 16 of 95 security vendors in aggregated scans, though no direct malware payloads have been confirmed. It appears on 5 security blocklists and is actively blocked by multiple cryptocurrency-focused security tools, including Polkadot and Enkrypt. The SSL certificate, issued by Google Trust Services (WE1), provides no inherent trust signal, as phishing domains frequently use valid certificates. AlienVault OTX records the domain in 23 threat intelligence pulses, further corroborating its malicious classification. Defenders should treat this domain as high-risk. The HTTP 523 status suggests intermittent availability, possibly due to takedown attempts or infrastructure instability. No legitimate presale or token contract has been verified for 'LILPEPE,' and the domain’s creation date (less than a year old) is consistent with short-lived phishing operations. Network-level blocking of 104.21.16.1 and associated Cloudflare IPs is recommended, alongside monitoring for related domains using similar naming conventions (e.g., 'pepe,' 'presale,' or token-themed keywords). Further investigation into the cryptocurrency wallet addresses or smart contracts promoted on the site may reveal additional indicators of compromise.