# PhishDestroy threat dossier — pumpwatchstreamer.fun ================================================================ Fetched: 2026-05-02 02:50:03 UTC Canonical: https://phishdestroy.io/domain/pumpwatchstreamer.fun/ ## VERDICT ---------------------------------------------------------------- ACTIVE + CLOAKED — returns HTTP 666 to scanners, real fraudulent site to victims Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Cloaking: DETECTED — domain returns custom HTTP 666 to scanners while serving fraudulent content to real users (type: content_divergence) (score: 2/6) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 1/94 security vendors flagged this domain Flagging vendors: alphaMountain.ai Public blocklists: listed on 2 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.96.3 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: CloudFlare, Inc. Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com Nameservers: ["ariadne.ns.cloudflare.com", "ignacio.ns.cloudflare.com"] Registered: 2026-04-22 Page title: Pump HTTP response: 200 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-22 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-22 15:23:22 UTC (by PhishDestroy tracker) Earliest abuse rec: 2026-04-22 12:27:21 UTC — PREDATES current WHOIS registration; retained from a previous registration cycle of the same domain name Last verified: 2026-04-30 19:40:27 UTC Current status: ACTIVE — cloaked behind HTTP 666 to evade scanners Note: one or more events above predate the WHOIS creation date. This typically means the same domain name was previously registered, detected, dropped, and then re-registered by a new party. PhishDestroy preserves the full historical record for operator-attribution research even when the underlying infrastructure changes hands. ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019db522-f975-7752-89cc-f4f2e4aa1167/ URLQuery: https://urlquery.net/report/2522b185-1782-4fb8-9206-a69220e3e219 Wayback Machine: https://web.archive.org/web/*/pumpwatchstreamer.fun crt.sh CT logs: https://crt.sh/?q=%25.pumpwatchstreamer.fun Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=pumpwatchstreamer.fun AlienVault OTX: https://otx.alienvault.com/indicator/domain/pumpwatchstreamer.fun URLhaus: https://urlhaus.abuse.ch/host/pumpwatchstreamer.fun/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-22 15:25:11 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy confirms that pumpwatchstreamer.fun is actively hosting a crypto drainer scam designed to trick cryptocurrency users into connecting their wallets and signing malicious transactions. The page presents a deceptive interface labeled "Pump" that mimics legitimate token-pumping or streaming services, leveraging urgency and fake incentives to prompt users to connect their Web3 wallets. Once connected, the site attempts to drain tokens via malicious contract interactions without requiring further user approval, a hallmark of crypto drainer malware. This domain has been observed distributing fraudulent links across social media and messaging platforms targeting users interested in cryptocurrency trading and real-time market data. This domain was flagged by multiple independent security systems including MetaMask and SEAL, and it appears on 2 public blocklists as of the latest scan. VirusTotal analysis shows 1 out of 95 security vendors detecting malicious content at the time of evaluation. The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on April 21, 2026, and is currently resolving to IP address 185.114.96.3. It uses a valid Let’s Encrypt SSL certificate, which increases its credibility to unsuspecting users. The recent creation date and automated certificate issuance suggest a hastily deployed operation aimed at exploiting early interest in speculative or emerging crypto services. If you have visited pumpwatchstreamer.fun, immediately disconnect your wallet from the site using your wallet’s UI or browser extension. Do not sign any additional transactions or approve new contracts. Revoke any unauthorized token approvals via reputable tools like revoke.cash or etherscan.io. Clear your browser cache and consider using a dedicated browser profile or hardware wallet for future transactions. Report the domain to your wallet provider, local cybercrime units, and security platforms like PhishDestroy or URLVoid. Avoid interacting with similar links promising unrealistic gains—always verify sources through official channels before engaging with crypto platforms. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260422-020FD6 Favicon MD5: 3b95f264ba9ca3874a7cd5528ce97142 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/pumpwatchstreamer.fun/ JSON API: https://api.destroy.tools/v1/check?domain=pumpwatchstreamer.fun Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io