pujmp[.]fun

PhishDestroy identifies pujmp.fun as an active PayPal credential-harvesting domain created on April 23, 2026. The site impersonates PayPal’s login interface to steal credentials and session tokens, with no known drainer kit publicly documented yet. The domain resolves to IP 104.21.57.41 and is protected by a Let’s Encrypt SSL certificate, increasing its deceptive authenticity. Registrant details are obscured through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently abused in low-effort phishing campaigns targeting financial services.

Technical indicators confirm elevated risk: VirusTotal shows 3/95 detections as of the latest scan, indicating evasion of current detection signatures. The domain was registered on April 23, 2026, and has not yet been flagged by Google Safe Browsing or major threat intelligence blocklists. WHOIS data reveals privacy protection via the registrar, and the hosting IP 104.21.57.41 is associated with multiple low-reputation domains. These factors suggest a recently deployed, minimally tracked operation with high potential for victim engagement.

The domain remains active and unblocked across most security platforms, posing an immediate threat to users entering PayPal credentials. Given the absence of detections and rapid deployment, PhishDestroy assesses this as a high-risk domain under active phishing operations. Users are advised to avoid interaction and report the domain to their security teams or browser vendors. Blocking at DNS and network levels is strongly recommended. Remaining risk is high until automated detection improves or manual intervention occurs.