pumpcrypto[.]xyz

The domain pumpcrypto.xyz has been identified as a brand impersonation threat specifically targeting DexScreener, a platform for decentralized exchange analytics. Analysis confirms the domain is currently offline, though it previously hosted content titled 'PUMP | Solana Meme Token,' which aligns with tactics used to deceive users into engaging with fraudulent cryptocurrency schemes. The impersonation of a trusted analytics platform suggests an intent to exploit user trust in legitimate services to facilitate unauthorized transactions or data harvesting. Infrastructure analysis reveals the domain was registered through REGRU-RU on August 4, 2025, and resolved to the IP address 188.114.97.3. Security vendor assessments indicate that 6 of 95 VirusTotal engines flagged the domain as malicious, reflecting an elevated risk profile. The domain appears on one security blocklist, specifically PhishDestroy, further corroborating its association with phishing activity. The combination of recent registration, low detection counts, and targeted brand impersonation underscores the need for heightened scrutiny. At present, pumpcrypto.xyz is offline, reducing immediate exposure risk. However, the domain's infrastructure remains intact, and similar campaigns may resurface under different domains. Organizations and users are advised to monitor for re-registration attempts, implement domain-based blocking for known malicious indicators, and verify the authenticity of cryptocurrency-related communications. Security teams should prioritize reviewing logs for connections to 188.114.97.3 and assess any interactions with the domain occurring prior to its takedown.