# PhishDestroy threat dossier — pumdp.fun
================================================================

Fetched:   2026-04-23 06:47:49 UTC
Canonical: https://phishdestroy.io/domain/pumdp.fun/

## VERDICT
----------------------------------------------------------------
ACTIVE + CLOAKED — returns HTTP 666 to scanners, real fraudulent site to victims
Composite threat score: 100/100 (PhishDestroy scoring — see methodology below)
Cloaking: DETECTED — domain returns custom HTTP 666 to scanners while serving fraudulent content to real users (type: content_split) (score: 1/6)

## DETECTION EVIDENCE
----------------------------------------------------------------
VirusTotal:      2/94 security vendors flagged this domain
  Flagging vendors: Chong Lua Dao, Forcepoint ThreatSeeker

## INFRASTRUCTURE
----------------------------------------------------------------
IP address:      172.67.179.113 (CA, Toronto)
ASN:             AS13335 Cloudflare, Inc.
Hosting org:     Cloudflare, Inc.
Registrar:       NameSilo, LLC

!!! REGISTRAR INTEGRITY ALERT — NameSilo !!!
NameSilo is a registrar documented by PhishDestroy as (1) publicly lying about
received abuse reports, (2) shielding a $20M+ Monero-theft operation (xmrwallet.com)
for 10 continuous years, and (3) retaliating against PhishDestroy by getting our
X/Twitter account @Phish_Destroy banned after we published the evidence.
Researchers/victims must ALWAYS CC compliance@icann.org on every abuse ticket —
NameSilo has a track record of later claiming reports were never received.
Primary sources:
  https://phishdestroy.io/namesilo-killed-our-twitter
  https://phishdestroy.io/xmrwallet-namesilo-exposed

Nameservers:     ["anna.ns.cloudflare.com", "eric.ns.cloudflare.com"]
Registered:      2026-04-21
Page title:      Pump

## TLS CERTIFICATE
----------------------------------------------------------------
Issuer:     Let's Encrypt / E8
Expires:    2026-06-02
Status:     INVALID chain
Fingerprint: 178f61a895006be8ddbe87e5180cc8371a89a64d2d4c0ba9650e4c72c3959a23

## ABUSE-REPORT HISTORY (evidence of registrar non-response)
----------------------------------------------------------------
Status: pending notification queue. No abuse reports filed yet — this domain is
waiting for the next cycle of our automated abuse-reporter.

## TIMELINE
----------------------------------------------------------------
Domain registered: 2026-04-21 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration)
First detected:    2026-04-21 13:33:33 UTC (by PhishDestroy tracker)
Last verified:     2026-04-23 07:40:10 UTC
Current status:    ACTIVE — cloaked behind HTTP 666 to evade scanners

## EXTERNAL CORROBORATION (third-party evidence)
----------------------------------------------------------------
URLScan.io:       https://urlscan.io/result/019daf97-60b4-76bd-bc4c-8a8f110672be/
Wayback Machine:  https://web.archive.org/web/*/pumdp.fun
crt.sh CT logs:   https://crt.sh/?q=%25.pumdp.fun
Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=pumdp.fun
AlienVault OTX:   https://otx.alienvault.com/indicator/domain/pumdp.fun
URLhaus:          https://urlhaus.abuse.ch/host/pumdp.fun/

## ANALYST NARRATIVE
----------------------------------------------------------------
[Generated: 2026-04-21 13:34:29 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.]

PhishDestroy has identified pumdp.fun as a live malicious domain hosting a crypto drainer, presenting an elevated risk to users who engage with it. The domain was registered on March 04, 2026, through NameSilo, LLC and resolves to a server at IP address 172.67.179.113. While only 1 out of 95 VirusTotal-supported security engines has flagged the domain, the presence of a Let’s Encrypt SSL certificate suggests an attempt to appear legitimate. The short domain age and low detection rate indicate a recently deployed threat with the potential for rapid growth and increased malicious activity in the near term, especially as the campaign scales against unsuspecting cryptocurrency users.

Technical analysis confirms the domain is associated with a crypto drainer aimed at illicitly transferring funds from digital wallets during transaction approvals. The lack of widespread detection (1/95) underscores the challenge security vendors face in identifying emerging, low-signal threats that may only begin to trigger alerts after multiple reports have been submitted. NameSilo’s role as the registrar raises concerns about due diligence, as bulk registrations with minimal identity verification can facilitate the rapid proliferation of such malicious domains. The combination of recent registration, low blocklist coverage, and hosting on a cloud IP further highlights the domain’s transient nature and potential to evade detection through IP rotation or rapid takedown evasion.

Users who have visited pumdp.fun or interacted with its content should immediately assess their cryptocurrency wallets for unauthorized transactions. If any funds have been drained, users should report the incident to local law enforcement and file a complaint with their financial institution. To prevent future exposure, users are strongly advised to verify any domain before engaging in transactions—especially those involving digital assets—by consulting reputable threat intelligence platforms like PhishDestroy, where this domain is actively monitored. Additionally, enable multi-factor authentication on all wallet and exchange accounts and consider using hardware wallets with transaction approval on trusted devices.

## EVIDENCE HASHES
----------------------------------------------------------------
Favicon MD5:       02af5b6696bb734e806685609b3b5d70
TLS cert SHA-256:      178f61a895006be8ddbe87e5180cc8371a89a64d2d4c0ba9650e4c72c3959a23

## SCORING METHODOLOGY
----------------------------------------------------------------
Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates:
  - VirusTotal positive ratio
  - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus,
    CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB)
  - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor)
  - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.)
  - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing
  - URLScan / URLQuery verdicts
  - Brand-impersonation heuristics (DOM analysis of forms, logos, wording)
  - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures)
  - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...)
  - Free-TLS vs paid-cert ratio (throwaway infrastructure signal)
  - Registrar/hosting abuse history (this registrar's track record)
  - Human researcher sign-off (volunteer takedown team)

A domain present in our database is ALREADY flagged. A low VT count by itself does
NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their
first 7–30 days while actively draining wallets. Always cross-reference the composite
score and the individual indicators above, not just VT.

## CORRECTIONS / APPEALS
----------------------------------------------------------------
Full HTML report:  https://phishdestroy.io/domain/pumdp.fun/
JSON API:          https://api.destroy.tools/v1/check?domain=pumdp.fun
Appeal a flag:     https://phishdestroy.io/appeals/  (responded to within 48 hours, FP rate <0.01%)
Submit a report:   https://t.me/PhishDestroy_bot

About PhishDestroy: volunteer-driven open-source threat-intelligence platform.
Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io