pepeunchained-migrate-new[.]dashboard-auth-secure[.]com

This domain, pepeunchained-migrate-new.dashboard-auth-secure.com, is actively engaged in credential theft targeting cryptocurrency users. Analysis indicates the site impersonates legitimate dashboard authentication portals, likely leveraging social engineering to harvest login credentials for subsequent unauthorized access to digital asset wallets. No explicit crypto drainer kit signatures have been observed, but the domain’s structure and naming convention suggest an intent to exploit users of decentralized finance platforms, particularly those associated with the Pepe Unchained token or similar projects. The use of terms like 'migrate' and 'auth-secure' in the subdomain further implies an attempt to mimic official migration or security verification processes, a common tactic in credential phishing campaigns. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Web Commerce Communications Limited, an uncommon registrar for legitimate cryptocurrency services. It resolves to the IP address 104.21.43.4, which is hosted on AS13335, a network frequently utilized for content delivery and proxy services. The domain appears on two security blocklists and is flagged by Google Safe Browsing as a phishing site. VirusTotal reports that 9 out of 95 security vendors have detected the domain as malicious, with detections from PhishDestroy and ScamSniffer contributing to its elevated risk classification. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the threat, as phishing sites commonly employ valid certificates to appear legitimate. As of the latest assessment, the domain remains active and continues to resolve, though it is partially mitigated by browser-based warnings, including a Cloudflare interstitial page titled 'Suspected phishing site.' No takedown requests or registrar enforcement actions have been observed at this time. The remaining risk is classified as elevated due to the domain’s persistence, its targeting of high-value cryptocurrency credentials, and its use of infrastructure that complicates attribution and mitigation. Users are advised to avoid interacting with the domain, verify the authenticity of any migration or authentication requests through official channels, and employ multi-factor authentication for all cryptocurrency-related accounts. Organizations should update blocklists to include this domain and monitor for related indicators of compromise.