pumpgift-x4n7[.]xyz

Analysis of pumpgift-x4n7.xyz indicates that the domain was registered on 29 November 2025 through NameCheap, Inc. The authoritative nameservers are jay.ns.cloudflare.com and nicole.ns.cloudflare.com, suggesting the use of Cloudflare’s DNS service. DNS resolution points to IP 193.24.123.248, which belongs to ASN 200593 (PROSPERO OOO) and is geolocated in Russia. No TLS certificate is presented; the site operates over HTTP only. The single page retrieved before takedown presented the title “Pump Game,” but the content of the page was not captured, so the exact phishing vector remains unknown.

The domain is listed on one public security blocklist and has been specifically blocked by the PhishDestroy feed. VirusTotal reports show that 13 of 95 scanning engines flagged the domain as malicious, reinforcing the suspicion of a phishing campaign. The current operational status is offline, indicating that the hosting may have been taken down or the site has been otherwise disabled. While the available data confirms malicious infrastructure and a probable phishing motive, the lack of SSL, limited content analysis, and absence of additional contextual indicators such as targeted brands or credential‑capture pages leave the precise attack surface uncertain.

Defenders should continue to monitor the IP address 193.24.123.248 for any re‑use, enforce blocking of the domain at network perimeter, and add the domain to internal deny lists. Organizations using email or web filters should ensure that the domain is included in threat‑intelligence feeds, especially those sourced from PhishDestroy and VirusTotal. Given the Russian hosting, attribution to a specific threat actor cannot be inferred from the current evidence. Ongoing collection of HTTP response headers, page snapshots, and any observed phishing lures would be required to fully characterize the campaign.