pump[.]terminalsol[.]xyz

The domain pump.terminalsol.xyz has been identified as a generic phishing threat. It was likely utilized in phishing campaigns targeting users through deceptive means, potentially involving fake login pages or brand impersonation. While specific brands or drainer kits associated with this domain are not identified, the domain's malicious nature is confirmed by its presence on multiple security blocklists.

Technical analysis reveals that pump.terminalsol.xyz resolves to the IP address 104.21.10.110. The domain has a VirusTotal detection score of 4 out of 95, indicating that a minority of security vendors have identified it as malicious. It was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a detail that may assist in tracking related activities. The domain was created on June 19, 2026, and is currently listed on two security blocklists. The SSL certificate is issued by Google Trust Services, which, while usually trustworthy, was likely compromised or misused in this instance.

Currently, the domain is offline, reducing its immediate threat level. However, the fact that it was flagged by security entities such as PhishDestroy and OISD suggests a history of malicious activity. Despite its offline status, it remains a potential risk if reactivated or if similar domains are registered by the same threat actors. Security teams should ensure that any systems with historical interactions with this domain are thoroughly scanned and that preventive measures, such as updated blocklists and phishing awareness training, are in place to mitigate future risks.