littlepepe-com-claim[.]live

The domain littlepepe-com-claim.live was registered on April 12, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the Cloudflare‑hosted address 188.114.97.3, which is associated with ASN 13335 in the United States. The authoritative name servers amber.ns.cloudflare.com and osmar.ns.cloudflare.com confirm that the domain is using Cloudflare’s DNS infrastructure. An SSL certificate issued by Let’s Encrypt (E7) is present, providing HTTPS encryption but offering no indication of legitimacy. The site presents the page title “WalletConnect – Secure Connection,” directly referencing the WalletConnect brand, and is classified as a crypto‑drainer impersonation campaign. VirusTotal analysis shows that seven of ninety‑one scanning engines flagged the domain as malicious, and the domain is listed on three external blocklists. Defensive services including PhishDestroy, MetaMask, and SEAL have already blocked the domain, reflecting a consensus among security products that the site is hostile. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the low confidence in the domain’s safety.

The observable evidence suggests that the attacker leveraged a legitimate‑looking TLS certificate and Cloudflare’s CDN to obscure the true origin of the malicious payload, a common tactic in brand‑impersonation operations targeting cryptocurrency users. While the exact content of the landing page has not been captured, the presence of the WalletConnect brand in the title and the designation as a crypto‑drainer imply that the site likely attempts to harvest private keys or redirect users to a malicious wallet connection flow.

Defenders should continue to monitor DNS queries for the 188.114.97.3 address and enforce blocklist updates that include littlepepe-com-claim.live. Endpoint protection solutions ought to incorporate the observed VirusTotal detections and the low Gridinsoft trust score into their heuristic models.