pepeheimer-claimlives[.]pages[.]dev

This domain, pepeheimer-claimlives.pages.dev, is identified as an active crypto drainer phishing site. Analysis confirms it deploys malicious scripts designed to siphon cryptocurrency assets from connected wallets, a threat type classified as a crypto drainer. The site impersonates Pepe Heimer, a known cryptocurrency project, to deceive users into authorizing transactions that result in unauthorized fund transfers. Current status remains active, with no signs of takedown or mitigation as of the latest verification. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., with a creation date of March 03, 2026, indicating a recently established malicious operation. It resolves to the IP address 172.66.44.212, hosted on Cloudflare’s network (AS13335). Security vendor assessments show 8 of 95 VirusTotal engines flag the domain as malicious, while it appears on 2 distinct security blocklists. The SSL certificate is issued by Let’s Encrypt (serial number E7), a common choice for both legitimate and malicious sites. Additional telemetry confirms the domain is actively blocked by PhishDestroy and ScamSniffer, further validating its malicious classification. Risk assessment categorizes this domain as high severity due to its direct financial impact on victims. Users are advised to block the domain at the network level and add the IP 172.66.44.212 to firewall deny lists. Cryptocurrency wallet providers should revoke any active session tokens associated with this domain. End users who interacted with the site must immediately disconnect their wallets, revoke all connected dApp permissions, and transfer remaining assets to a new, secure wallet. Monitoring for unauthorized transactions is critical, as crypto drainers often operate silently post-compromise.