xn--pnp-50a[.]fun

This domain, xn--pnp-50a.fun, is identified as a crypto drainer phishing site designed to mimic legitimate cryptocurrency wallet interfaces. Analysis of the page title, 'Pump,' and associated infrastructure suggests an intent to deceive users into connecting wallets, enabling unauthorized asset transfers. No direct brand impersonation is evident, but the domain leverages common phishing tactics to exploit users during high-activity events, such as token launches or airdrops. The lack of a known drainer kit signature does not preclude custom or obfuscated malicious code, which may evade initial detection by security tools.

Technical indicators confirm the domain's malicious nature. It is flagged by 5 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The domain was registered on March 02, 2026, through Dynadot LLC and resolves to the IP address 172.67.177.188, hosted on a content delivery network. It appears on four security blocklists, including MetaMask and PhishDestroy, and is associated with technologies such as Apple iCloud Mail, Amazon Web Services, and Vercel. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites. Google Safe Browsing status is not explicitly provided, but the domain's presence on multiple blocklists indicates widespread recognition of its malicious intent.

As of the latest assessment, xn--pnp-50a.fun has been taken offline, likely in response to security vendor interventions or hosting provider actions. However, the infrastructure remains a residual risk due to the potential for rapid redeployment under a new domain or IP address. Users who interacted with the site should assume wallet compromise and take immediate action, including revoking wallet permissions, transferring assets to a new wallet, and monitoring for unauthorized transactions. Organizations should update blocklists to include this domain and its associated indicators, while end-users are advised to verify domain authenticity before connecting wallets or entering sensitive information.