pwmp[.]fun

This domain is flagged for elevated-risk brand impersonation targeting Curve, a financial services platform. Analysis indicates the infrastructure was designed to deceive users into believing they were interacting with legitimate Curve services, likely to harvest credentials or financial data. The page title, "Greenland Defense Front (Greenland) - Pump," suggests an attempt to obfuscate the true purpose of the domain, possibly by leveraging unrelated content to evade detection or confuse automated analysis tools.

Infrastructure analysis reveals the domain was registered on February 21, 2026, through ERANET INTERNATIONAL LIMITED. It resolves to the IP address 172.67.155.173 and has been detected by 6 out of 95 security vendors on VirusTotal. The domain appears on four security blocklists and is associated with one threat intelligence pulse on AlienVault OTX. Additional detections include blocking by ScamSniffer, PhishDestroy, Enkrypt, and Maltrail. The Gridinsoft trust score for this domain is 0/100, further confirming its malicious classification. The domain is currently offline, but its prior activity and detection history warrant continued monitoring.

Mitigation for brand impersonation threats involves several technical and procedural steps. Organizations should implement domain monitoring to detect newly registered domains resembling their brand names, including common typosquatting variations. Deploying DNS-based blocking for known malicious IPs, such as 172.67.155.173, can prevent access to confirmed phishing infrastructure. Security teams should also integrate threat intelligence feeds, such as those from blocklists and AlienVault OTX, into their detection and response workflows. End-user training should emphasize verifying domain authenticity and reporting suspicious communications. If the domain reactivates, immediate takedown requests should be submitted to the registrar and hosting provider, supported by evidence from security vendors and threat intelligence platforms.