xn--pmp-qxa[.]fun

The domain xn--pmp-qxa.fun is a confirmed generic phishing site posing an elevated risk. It does not impersonate a specific brand or deploy a known crypto drainer kit. As of the latest verification, xn--pmp-qxa.fun has been taken offline, though it previously operated as a phishing page targeting users with fraudulent login or credential harvesting schemes.

Technical indicators for xn--pmp-qxa.fun include 3 of 95 VirusTotal security vendors flagging the domain, including alphaMountain.ai, Gridinsoft, and SOCRadar. The domain was registered through Dynadot Inc on March 24, 2026, and resolved to the IP address 188.114.97.3, hosted by CloudFlare in Canada. It appears on 3 security blocklists, specifically PhishDestroy, MetaMask, and SEAL. The SSL certificate was issued by Let's Encrypt (E7), and the observed page title was 'about:privatebrowsing'. Google Safe Browsing did not flag the domain at the time of analysis.

Users who may have interacted with xn--pmp-qxa.fun should immediately change any passwords entered on the site, enable two-factor authentication (2FA) on affected accounts, and monitor for unauthorized transactions or identity fraud. If financial or crypto assets were exposed, revoke any token approvals and consider transferring funds to a new wallet. Report the phishing domain to local cybersecurity authorities or platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group (APWG) to aid in broader mitigation efforts.