fun-show[.]xyz

fun-show.xyz impersonates the brand Pump.fun and was flagged by 7 out of 95 vendors on VirusTotal as malicious. The domain has been taken offline, but it remains listed on three public blocklists, including PhishDestroy, MetaMask, and SEAL. This indicates a coordinated effort to mitigate its impact. The domain was registered through Dynadot Inc and hosted on IP address 94.103.1.156 in the Netherlands, under the organization Digital Hosting Provider LLC.

The domain's SSL certificate was issued by Let's Encrypt, a common choice for phishing domains due to its automated and free certificate issuance. fun-show.xyz was created on June 12, 2026, and PhishDestroy identified it on June 18, 2026, just six days later. This rapid detection underscores the effectiveness of PhishDestroy's monitoring capabilities in identifying threats before they can cause significant harm.

Despite its offline status, fun-show.xyz achieved a platform risk score of 75 out of 100, indicating a high level of threat during its operational period. The impersonation of Pump.fun suggests a targeted approach, likely aiming to deceive users into believing they were interacting with the legitimate brand. Phishing domains like fun-show.xyz exploit the gap between domain registration and antivirus database updates, highlighting the need for real-time threat intelligence solutions to protect users from emerging threats.