furpun[.]xyz

Analysis of the domain furpun.xyz, registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, indicates active phishing infrastructure targeting users under the guise of a server update. As of July 19, 2026, the domain resolves to the IP address 89.110.94.142, hosted in Russia by Hosting technology LTD. The domain's nameservers, ns3.my-ndns.com and ns4.my-ndds.com, are consistent with previously observed phishing campaigns, though no specific brand impersonation has been confirmed from the available data. The page title 'Updating server...' suggests an attempt to deceive users into believing they are interacting with a legitimate maintenance or authentication portal, though the exact content and functionality of the site remain unanalyzed. Infrastructure analysis reveals that furpun.xyz is flagged by at least one security blocklist, including PhishDestroy, and appears in three AlienVault OTX threat intelligence pulses, indicating prior detection by the security community. VirusTotal reports that 6 of 91 security vendors classify this domain as malicious, though this detection rate should not be interpreted as exhaustive or definitive. The domain's SSL certificate, issued by Let's Encrypt (identifier YE2), does not mitigate its malicious nature, as phishing sites frequently employ valid certificates to appear legitimate. Defenders are advised to block the domain furpun.xyz and its associated IP 89.110.94.142 at the network level. Monitoring for connections to the nameservers ns3.my-ndns.com and ns4.my-ndds.com may also aid in identifying compromised systems or additional malicious domains. Given the domain's active status and minimal detections, organizations should prioritize this threat for further investigation, particularly if internal logs indicate user interaction with the site. No specific brand or scam category has been confirmed, so generic phishing detection rules should be applied.