pepeunchainedtoken[.]site

Analysis of pepeunchainedtoken.site as of July 24, 2026 indicates that the domain is actively used for a crypto‑related phishing campaign. The site was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is hosted behind Cloudflare (AS13335). DNS resolution points to 172.67.139.26, an IP belonging to Cloudflare’s network in the United States. The domain employs a Google Trust Services / WE1 SSL certificate, which provides a valid HTTPS connection but does not guarantee legitimacy.

HTTP requests return a 403 status code and the only observable page title is “Just a moment…”, suggesting that the site may be serving a challenge page or redirect before delivering malicious content. Security‑vendor scans on VirusTotal show that one of ninety‑three scanners flagged the domain, and the domain appears on a single external blocklist. Independent phishing‑detection services such as PhishDestroy have already listed the domain as malicious, while the Gridinsoft trust score is 0 out of 100, reinforcing the high‑risk assessment. The infrastructure leverages Cloudflare Browser Insights and HTTP/3, typical of many fast‑flux or content‑delivery setups used to hide the true origin of malicious payloads.

Evidence confirms the presence of a crypto scam classification, but the exact payload, credential‑harvesting mechanism, or targeted cryptocurrency platform has not been publicly disclosed. Defenders should treat any traffic to pepeunchainedtoken.site as hostile. Recommended actions include blocking the domain at the network perimeter, adding the associated IP address (172.67.139.26) to deny lists, and monitoring for related DNS queries to josephine.ns.cloudflare.com and lee.ns.cloudflare.com. Continuous re‑evaluation is advised, as the site may evolve its tactics or host additional malicious resources.