prrump[.]fun

The domain prrump.fun is identified as a high-risk credential theft operation specifically targeting cryptocurrency users. Analysis indicates this infrastructure was designed to harvest wallet credentials, private keys, or multi-factor authentication codes through deceptive login portals. Currently, the domain is offline, though historical activity suggests it may resurface under altered infrastructure or similar naming conventions. Infrastructure analysis reveals the domain was registered on April 05, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with abusive registrations. It resolved to the IP address 104.21.86.152, which is part of a content delivery network known for masking origin servers. Security vendors flagged this domain in 18 of 95 VirusTotal scans, while Gridinsoft assigned a trust score of 0 out of 100. The domain appears on three security blocklists, including PhishDestroy, ScamSniffer, and Maltrail. Detected technologies include Cloudflare, Cloudflare Browser Insights, and HTTP/3, indicating the use of modern evasion techniques to bypass traditional security controls. Given the domain's current offline status, organizations and users should remain vigilant for reactivation attempts or successor domains leveraging similar naming patterns. Network defenders are advised to block the IP address 104.21.86.152 and monitor for related indicators of compromise, such as connections to newly registered domains under the same registrar. Cryptocurrency users should verify all login portals through official channels and enable hardware-based multi-factor authentication to mitigate credential theft risks. Security teams are encouraged to correlate this domain with internal logs to identify potential prior exposure or lateral movement within affected environments.