xn--live-pmp-t5a[.]fun

This domain, xn--live-pmp-t5a.fun, is flagged as an elevated-risk cryptocurrency wallet phishing resource. Analysis indicates it was specifically designed to impersonate legitimate digital asset management platforms, likely targeting users through deceptive wallet interfaces or credential harvesting mechanisms. The page title 'Pump' suggests an attempt to exploit market volatility or trending cryptocurrency events to lure victims into interacting with malicious infrastructure. Infrastructure analysis reveals the domain was registered on March 2, 2026, through Dynadot LLC, a registrar frequently observed in phishing operations. It resolves to IP address 172.67.204.176 and employs a Let's Encrypt SSL certificate, providing a superficial layer of legitimacy. Detection metrics show the domain appears on four security blocklists (MetaMask, PhishDestroy, SEAL, and Maltrail) and is flagged by 2 out of 95 security vendors on VirusTotal. The Gridinsoft trust score of 0/100 further corroborates its malicious classification. Detected technologies include Apple iCloud Mail, Amazon Web Services, Vercel, web-vitals, Unpkg, LaunchDarkly, HSTS, and Google Tag Manager, indicating a sophisticated deployment likely leveraging cloud-based hosting and tracking capabilities. Mitigation measures should focus on cryptocurrency-specific phishing defenses. Network administrators are advised to implement DNS-based blocking for the domain and its resolving IP address. End-users should be educated on verifying domain authenticity, particularly for Punycode-encoded URLs (xn--live-pmp-t5a.fun), which may visually resemble legitimate platforms. Wallet software providers are recommended to integrate real-time phishing detection for known malicious domains and enforce strict transaction confirmation protocols. Organizations handling digital assets should monitor for unauthorized access attempts originating from this domain or its associated infrastructure.