# PhishDestroy domain threat record: pumpstreamx.fun

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/pumpstreamx.fun/
Machine-readable companion: https://phishdestroy.io/domain/pumpstreamx.fun/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-27 04:24:05 UTC
- Last availability or vendor check: 2026-10-28 12:13:05 UTC
- Stored record updated: 2026-10-28 12:13:05 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 188.114.97.3
- Registrar in stored WHOIS data: NameSilo, LLC
- Registrar country in stored WHOIS data: US
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/01a17b98-a67a-74db-8f87-3d44685381fd/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/pumpstreamx.fun
- Certificate Transparency search: https://crt.sh/?q=%25.pumpstreamx.fun
- Web Archive lookup: https://web.archive.org/web/*/https://pumpstreamx.fun/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake AI assessed the site as malicious because it mimics the legitimate pump.fun brand and advertises a “Pump app” for download, a pattern commonly used for malware distribution. The recorded page title is “Pump” and the page excerpt includes the phrase “Pump app ✕ Scan to download”. The domain was first seen by PhishDestroy on 2026-10-27 and returned an HTTP 200 response on that date. The assessment is based on brand impersonation and the presence of a download prompt, not on observed malicious payloads.

How the scam works
In brand‑impersonation scams an attacker registers a look‑alike domain, copies visual elements of a trusted service and offers a downloadable application that may contain malware or harvest credentials. The advertised “Pump app” is presented as a legitimate tool for the pump.fun ecosystem, enticing users to install software that could compromise their devices or cryptocurrency wallets.

Evidence
VirusTotal scanned the domain on 2026-10-27 with 92 engines and reported zero detections and no suspicious flags. Google Safe Browsing checked the URL on the same day and did not flag it. urlscan.io recorded the page on 2026-10-27; its machine‑learning engine labeled the URL as malicious with a high confidence score, but the overall verdict was non‑malicious. External blocklists MetaMask and SEAL listed the domain, and PhishDestroy’s internal blocklist also contains it. The intake report captured a page excerpt mentioning a “Pump app” download, supporting the brand‑impersonation concern.

Infrastructure
The domain was registered with NameSilo on 2026-10-25, two days before first observation. Recorded DNS records listed Cloudflare IPv4 addresses 172.67.181.228 and 104.21.32.3 and IPv6 address 2a06:98c1:3121::3, indicating the site was served through Cloudflare’s network at the time of capture. A Let’s Encrypt TLS certificate for *.pumpstreamx.fun was issued on 2026-10-25 and was valid until 2027-01-23; DNSSEC was not enabled.

What to do
Do not download or run any software offered on pumpstreamx.fun and avoid entering credentials or wallet approvals on the site. Defenders should block the exact domain, monitor outbound traffic for connections to the recorded host, and add the domain to internal blocklists to prevent future access.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17b98-a67a-74db-8f87-3d44685381fd/
Cloudflare Radar report: https://radar.cloudflare.com/scan/7a8748a6-b99d-47b6-aad2-99eaccbff8d3
URLQuery report: https://urlquery.net/report/fecf39ea-d8ba-4c42-943f-1d428a4a68ea
Stored capture screenshot: https://i.ibb.co/ym4DZCFb/140b262145dd.png
Cloudflare Radar screenshot (2026-10-27T05:02:38Z): https://screenshots.phishdestroy.io/cf/7a8748a6-b99d-47b6-aad2-99eaccbff8d3.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/fecf39ea-d8ba-4c42-943f-1d428a4a68ea.png
URLScan screenshot (2026-10-27T04:34:53Z): https://screenshots.phishdestroy.io/us/01a17ba3-a7e7-7617-998f-be53d605f1b1.png
URLScan capture report: https://urlscan.io/result/01a17ba3-a7e7-7617-998f-be53d605f1b1/
VirusTotal report: https://www.virustotal.com/gui/domain/pumpstreamx.fun
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=pumpstreamx.fun
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-27 05:39:19 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/ym4DZCFb/140b262145dd.png
  Captured: 2026-10-27 04:24:05 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a17b98-a67a-74db-8f87-3d44685381fd.png
  Captured: 2026-10-27 04:24:05 UTC
  Source report: https://urlscan.io/result/01a17b98-a67a-74db-8f87-3d44685381fd/
- URLScan · 2026-10-27: https://screenshots.phishdestroy.io/us/01a17ba3-a7e7-7617-998f-be53d605f1b1.png
  Captured: 2026-10-27 04:34:53 UTC
  Source report: https://urlscan.io/result/01a17ba3-a7e7-7617-998f-be53d605f1b1/
  SHA-256: 64dc9b64a021099312de0b8b72f702405a9bb7ea884e0ae6372c4058f8d72eae
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/7a8748a6-b99d-47b6-aad2-99eaccbff8d3.png
  Captured: 2026-10-27 05:02:38 UTC
  Source report: https://radar.cloudflare.com/scan/7a8748a6-b99d-47b6-aad2-99eaccbff8d3
  SHA-256: 9e68d798786fd422f0d642b4f6d6097946956260812108e8a58f26dc22105ffd
- URLQuery: https://screenshots.phishdestroy.io/uq/fecf39ea-d8ba-4c42-943f-1d428a4a68ea.png
  Source report: https://urlquery.net/report/fecf39ea-d8ba-4c42-943f-1d428a4a68ea
  SHA-256: 5981d88735ef61d1e4fd9f445168d0b02278f62e84281f5ad797fce47b1f0f4d

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-27T05:05:57Z",
        "uuid": "01a17b98-a67a-74db-8f87-3d44685381fd",
        "scanned_at": "2026-10-27T04:22:51Z",
        "final_url": "https://pumpstreamx.fun/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://pumpstreamx.fun/",
                "from": "http://pumpstreamx.fun/",
                "status": 307
            }
        ],
        "ip": "2a06:98c1:3121::3",
        "domains": [
            "dexscreener.com",
            "firestore.googleapis.com",
            "encrypted-tbn0.gstatic.com",
            "identitytoolkit.googleapis.com",
            "www.googleapis.com",
            "dex-screener-16543.firebaseapp.com",
            "apis.google.com",
            "io.dexscreener.com",
            "firebaseinstallations.googleapis.com",
            "firebase.googleapis.com",
            "fonts.gstatic.com",
            "cdn.dexscreener.com",
            "www.googletagmanager.com",
            "fonts.googleapis.com",
            "pls.dexscreener.com",
            "upload.wikimedia.org",
            "cdn2.cdnstep.com",
            "t3.ftcdn.net",
            "pump.mypinata.cloud",
            "logos-world.net",
            "feed.dexscreener.com"
        ],
        "ips": [
            "142.251.20.95",
            "2a00:1450:4001:c0f::5f",
            "172.217.118.4",
            "2620:0:890::100",
            "2a00:1450:4001:c25::61",
            "2a00:1450:4001:c17::65",
            "2001:4860:4843:400::",
            "2001:4860:4841:400::",
            "2a00:1450:4001:c17::5f",
            "142.251.127.94",
            "188.114.97.3",
            "172.64.149.113",
            "2a02:ec80:300:ed1a::2:b",
            "2606:4700:3034::6815:cf1",
            "151.101.65.91"
        ],
        "asns": [
            "15169",
            "54113",
            "13335",
            "14907"
        ],
        "countries": [
            "US",
            "DE"
        ],
        "link_domains": [
            "solana.com",
            "x.com",
            "www.orca.so",
            "solscan.io",
            "marketplace.dexscreener.com",
            "www.tradingview.com"
        ],
        "social": [
            "https://x.com/solana"
        ],
        "doc_hash": "834bce4f41eb6c63ed24f67720e59b7332a8ef54e8c7e46725464459eae6c83f",
        "script_hashes": [
            "1c86e1bc414a887f24f26844dfe9bf3cd453703a4220ae1c70499009adf4c18e"
        ],
        "globals": [
            "updateChartEmbed",
            "changeChartInterval",
            "changeChartRange",
            "loadToken",
            "formatMarketCap",
            "formatPrice",
            "updateUTCTime",
            "updateViewers",
            "scheduleUpdate",
            "_0uwv",
            "litPropertyMetadata",
            "reactiveElementVersions",
            "litHtmlVersions",
            "litElementVersions",
            "tokenSlug",
            "previousMarketCap",
            "refreshInterval",
            "currentChartAddress",
            "viewers"
        ],
        "cookies": [
            "__cf_ob",
            "cf_clearance",
            "__cf_bm"
        ],
        "storage_keys": [
            "_0x12",
            "_0x5"
        ],
        "tls": {
            "san": [
                "*.pumpstreamx.fun",
                "pumpstreamx.fun"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "pumpstreamx.fun",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-23T08:02:38Z",
            "valid_from": "2026-10-25T08:02:39Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 1,
        "tls_valid_days": 89,
        "requests": 185,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 93,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-27T05:05:59Z",
        "uuid": "7a8748a6-b99d-47b6-aad2-99eaccbff8d3",
        "scanned_at": "2026-10-27T05:02:38Z",
        "final_url": "https://pumpstreamx.fun/",
        "status": 200,
        "history": [
            {
                "url": "https://pumpstreamx.fun/",
                "status": 200
            }
        ],
        "dom_hash": "d13ebf74562c7944eb49711e82543e5e43482be26d0b5dc23bd23589d81ece7d",
        "doc_hash": "f86c823a2a8d94af04980aa96b666c1679242a88da0062ae96f576b5e4fc27a6",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks",
            "New Domains"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "pumpstreamx.fun",
                "type": "A",
                "value": "172.67.181.228"
            },
            {
                "name": "pumpstreamx.fun",
                "type": "A",
                "value": "104.21.32.3"
            },
            {
                "name": "pumpstreamx.fun",
                "type": "AAAA",
                "value": "2606:4700:3033::ac43:b5e4"
            },
            {
                "name": "pumpstreamx.fun",
                "type": "AAAA",
                "value": "2606:4700:3032::6815:2003"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.181.228",
        "whois": {
            "registrar": "NameSilo, LLC",
            "created": "2026-10-25T08:54:43Z",
            "updated": "2026-10-25T08:54:44Z",
            "expires": "2027-10-25T08:54:43Z",
            "nameservers": [
                "fonzie.ns.cloudflare.com",
                "luciana.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-27T05:34:57Z",
        "analysis_at": "2026-10-27T05:18:05Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 37
        },
        "reputation": 0,
        "first_seen": "2026-10-25T09:08:09Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.181.228"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::6815:2003"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "fonzie.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.32.3"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3033::ac43:b5e4"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "fonzie.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "luciana.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-27T05:23:31Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.pumpstreamx.fun",
                "pumpstreamx.fun"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "53e98705b73cb6593bd76a4944fe5d0cb4b",
            "sha256": "701ab1832c997c6675a563c3fb2c37885fabee1262d49313be70d86f7dafdf5a",
            "subject": "pumpstreamx.fun",
            "valid_to": "2027-01-23T08:02:38Z",
            "valid_from": "2026-10-25T08:02:39Z"
        },
        "rdap": {
            "status": [
                "client transfer prohibited",
                "add period"
            ],
            "events": {
                "expiration": "2027-10-25T08:54:43Z",
                "last changed": "2026-10-25T08:54:44Z",
                "registration": "2026-10-25T08:54:43Z",
                "last update of RDAP database": "2026-10-25T09:07:58Z"
            },
            "registrar": "NameSilo, LLC",
            "registrar_iana_id": "1479"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-27T05:06:22Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "pumpstreamx.fun"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "social_tags": {
            "title": "Pump"
        },
        "trackers": {
            "requests": 38,
            "trackers": [
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 7
                },
                {
                    "name": "WikiMedia",
                    "company": "Wikimedia Foundation",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 64,
                "tls": 20,
                "wait": 1433,
                "connect": 53,
                "download": 1
            },
            "response_ms": 1571
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 69541,
            "co2_grams": 0.0025,
            "cleaner_than": 30
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.34.131",
                    "host": "luciana.ns.cloudflare.com"
                },
                {
                    "ip": "162.159.44.70",
                    "host": "fonzie.ns.cloudflare.com"
                }
            ],
            "zone": "pumpstreamx.fun"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "__cf_ob",
                    "secure": true,
                    "session": true,
                    "same_site": "None"
                },
                {
                    "name": "WMF-Uniq",
                    "secure": true,
                    "http_only": true,
                    "same_site": "None"
                },
                {
                    "name": "cf_clearance",
                    "secure": true,
                    "http_only": true,
                    "same_site": "None"
                },
                {
                    "name": "__cf_bm",
                    "secure": true,
                    "http_only": true,
                    "same_site": "None"
                }
            ]
        },
        "location": {
            "ip": "2a06:98c1:3121::3",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "pumpstreamx.fun"
        },
        "dns": {
            "A": [
                "188.114.97.3",
                "188.114.96.3"
            ],
            "NS": [
                "luciana.ns.cloudflare.com",
                "fonzie.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"fonzie.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418520574, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2a06:98c1:3120::3",
                "2a06:98c1:3121::3"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3120::3",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://pumpstreamx.fun"
            ]
        },
        "linked_pages": {
            "internal_count": 1
        },
        "whois": {
            "registrar": "NameSilo, LLC",
            "created": "2026-10-25T08:54:43Z",
            "updated": "2026-10-25T08:54:44Z",
            "expires": "2027-10-25T08:54:43Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp",
                "addPeriod https://icann.org/epp"
            ],
            "nameservers": [
                "fonzie.ns.cloudflare.com",
                "luciana.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8"
            }
        }
    }
}
```