ponkverse[.]fun

PhishDestroy identifies ponkverse.fun as an active domain engaged in cryptocurrency giveaway phishing, currently under investigation as a credible threat. No specific brand impersonation has been confirmed at this stage, but the site’s content and tactics align with common ‘pump-and-dump’ schemes targeting retail investors. This domain was flagged by 1 of 95 VirusTotal vendors as of the latest scan, indicating no immediate detection despite suspicious activity. Registered through Dynadot LLC, it resolves to IP 104.21.6.129 and operates under a Let’s Encrypt SSL certificate issued on May 12, 2026. The domain’s recent creation date and pristine reputation metrics—coupled with its lack of blocklist presence—suggest an emergent or highly evasive threat. The absence of detections, while concerning, often correlates with novel or rapidly evolving phishing infrastructures exploiting low initial visibility. Given the domain’s active status and the nature of its alleged campaign, users are advised to avoid interacting with ponkverse.fun entirely. Security teams should implement DNS-based blocking against the IP and domain entry, and monitor lateral connections for signs of compromise. Further investigation into the SSL certificate’s issuance and the hosting infrastructure may reveal additional indicators of compromise. Immediate action is recommended to mitigate exposure to cryptocurrency-focused social engineering attacks.