pumia[.]app

PhishDestroy identifies pumia.app as a recently activated credential theft domain leveraging trust hijacking and fake login portals to harvest user credentials. This subdomain mimics authentic financial or cryptocurrency service interfaces—likely targeting users through Discord, Telegram, or impersonated exchange announcements—aiming to drain digital assets once login credentials and 2FA codes are captured. While no publicly documented drainer kit has been matched to this campaign yet, the operational pattern aligns with classic credential harvesting lures used to siphon crypto funds via unauthorized API access or session hijacking.

Technical indicators confirm elevated risk: the domain bears a valid Let’s Encrypt SSL certificate but was only created on April 03, 2026—suggesting rapid deployment. It resolves to IP 193.142.59.10 and is registered through Fewmoretaps OU d/b/a Trustname.com, a registrar known for anonymity-focused services. VirusTotal analysis shows 14 out of 95 engines detect malicious intent. Google Safe Browsing (GSB) status remains unclassified at this time, and while some blocklists may include it, open-source intelligence indicates inconsistent coverage. The domain’s age and deployment vector suggest opportunistic credential theft rather than a mature, tracked drainer suite.

As of analysis, pumia.app remains active and unblocked by major browsers or security platforms. Immediate user actions include blocking the domain at DNS level, avoiding any login attempts, and reporting to PhishDestroy and local CERT teams. Remaining risk is elevated due to active operation and low blocklist presence, with potential for rapid expansion into phishing-as-a-service offerings. Users should verify any related links via official channels and enable hardware-based 2FA where possible.