xn--vpmp-w7a[.]fun

This domain, xn--vpmp-w7a.fun, operates as a crypto drainer targeting users of Curve Finance, a decentralized finance protocol. The site is designed to trick visitors into connecting their cryptocurrency wallets under the guise of a legitimate token or liquidity event, such as the referenced "Lob Deng (LOBDENG) - Pump." Once connected, the site executes unauthorized transactions, draining funds from the victim's wallet. The use of a punycode domain (xn--) suggests an attempt to mimic a legitimate URL, increasing the likelihood of deception among users unfamiliar with such encoding tactics. Analysis indicates this domain was registered on February 21, 2026, through Dynadot LLC, a registrar commonly used for both legitimate and malicious domains. The site resolves to the IP address 104.21.38.144 and employs a Let's Encrypt SSL certificate, which provides a false sense of security to visitors. It is flagged by 13 out of 95 security vendors on VirusTotal, and its infrastructure includes technologies such as Amazon Web Services, Vercel, and Google Tag Manager. The domain appears on five security blocklists, including MetaMask and ScamSniffer, further confirming its malicious intent. The page title, "Lob Deng (LOBDENG) - Pump," is a social engineering tactic designed to create urgency and exploit FOMO (fear of missing out) among cryptocurrency traders. If a user has visited this domain or interacted with its content, immediate action is required to mitigate potential losses. First, disconnect any connected wallets from the site and revoke any suspicious permissions granted to decentralized applications (dApps) via wallet settings. Next, scan the device for malware or unauthorized extensions that may have been installed during the interaction. Monitor all linked accounts, including cryptocurrency wallets and exchanges, for unauthorized transactions. If funds were stolen, report the incident to relevant law enforcement or cybercrime units, providing transaction hashes and any other evidence. Users should also enable transaction simulation tools or wallet security features to preview actions before approving them in the future.