# PhishDestroy threat dossier — v2-pumpswap.click
================================================================

Fetched:   2026-06-21 02:52:23 UTC
Canonical: https://phishdestroy.io/domain/v2-pumpswap.click/

## VERDICT
----------------------------------------------------------------
TAKEN DOWN (neutralised)
Composite threat score: 79/100 (PhishDestroy scoring — see methodology below)

## DETECTION EVIDENCE
----------------------------------------------------------------
VirusTotal:      8/91 security vendors flagged this domain
  Flagging vendors: ADMINUSLabs, alphaMountain.ai, BitDefender, ESET, Fortinet, G-Data, Gridinsoft, Kaspersky
AlienVault OTX:  2 pulses (threat-intel feed mentions)
Public blocklists: listed on 3 independent blocklists

## INFRASTRUCTURE
----------------------------------------------------------------
Registrar:       Dynadot, LLC
Nameservers:     ["ns1.dyna-ns.net", "ns2.dyna-ns.net"]
Registered:      2026-05-20
Expires:         2027-05-20
HTTP response:   530

## ABUSE-REPORT HISTORY (evidence of registrar non-response)
----------------------------------------------------------------
Status: CLOSED — no report required.
This domain was neutralised before the abuse-report cycle could be dispatched — either
the hosting provider / registrar suspended it on their own, the DNS went dead, or the
operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file
for audit but no formal notice was sent.

## TIMELINE
----------------------------------------------------------------
Domain registered: 2026-05-20 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration)
First detected:    2026-05-26 05:30:12 UTC (by PhishDestroy tracker)
First reported:    2026-06-15 00:27:29 UTC (abuse notice filed)
Last verified:     2026-06-21 04:20:34 UTC
Neutralised:       2026-05-29 00:22:50 UTC
Current status:    taken down (registrar suspended or DNS dead)

## ANALYST NARRATIVE
----------------------------------------------------------------
[Generated: 2026-06-18 16:50:13 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.]

The domain v2-pumpswap.click has been identified as a generic phishing domain, currently in an offline status, which suggests that it may have been taken down by authorities or the registrar. This domain is particularly concerning as it has been flagged by 8 of 95 VirusTotal vendors, indicating a significant threat to users who may have interacted with it. Furthermore, it was registered through Dynadot, LLC, and has been found in 2 threat intelligence pulses on AlienVault OTX, highlighting its malicious intent.

The technical indicators for v2-pumpswap.click paint a worrisome picture, with the domain being created as recently as May 20, 2026, and already appearing on 3 security blocklists. This swift escalation in threat level underscores the urgency of addressing this domain's potential impact. The fact that it was flagged by a notable number of VirusTotal vendors and has been included in multiple threat intelligence pulses signifies a coordinated effort to combat its malicious activities. Given these details, it is crucial to approach this domain with caution and prioritize user safety above all.

Given the current offline status of v2-pumpswap.click, it is essential for users to remain vigilant and take concrete steps to protect themselves from similar threats in the future. PhishDestroy recommends avoiding any interactions with unfamiliar websites, especially those that request sensitive information or prompt for urgent actions. Moreover, keeping software and security solutions up to date can significantly reduce the risk of falling prey to phishing attacks. By staying informed and adopting a proactive approach to cybersecurity, individuals can effectively safeguard their digital presence and minimize the risk posed by generic phishing domains like v2-pumpswap.click.

## SCORING METHODOLOGY
----------------------------------------------------------------
Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates:
  - VirusTotal positive ratio
  - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus,
    CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB)
  - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor)
  - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.)
  - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing
  - URLScan / URLQuery verdicts
  - Brand-impersonation heuristics (DOM analysis of forms, logos, wording)
  - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures)
  - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...)
  - Free-TLS vs paid-cert ratio (throwaway infrastructure signal)
  - Registrar/hosting abuse history (this registrar's track record)
  - Human researcher sign-off (volunteer takedown team)

A domain present in our database is ALREADY flagged. A low VT count by itself does
NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their
first 7–30 days while actively draining wallets. Always cross-reference the composite
score and the individual indicators above, not just VT.

## CORRECTIONS / APPEALS
----------------------------------------------------------------
Full HTML report:  https://phishdestroy.io/domain/v2-pumpswap.click/
JSON API:          https://api.destroy.tools/v1/check?domain=v2-pumpswap.click
Appeal a flag:     https://phishdestroy.io/appeals/  (responded to within 48 hours, FP rate <0.01%)
Submit a report:   https://t.me/PhishDestroy_bot

About PhishDestroy: volunteer-driven open-source threat-intelligence platform.
Tracked: 167,129 domains (16,052 alive under monitoring, 150,759 confirmed takedowns/dead). Site: https://phishdestroy.io