pmump[.]fun

This domain, pmump.fun, has been identified as a credential harvesting phishing site targeting users through deceptive login interfaces. The domain is currently offline, though prior analysis confirms its use in phishing campaigns designed to capture sensitive authentication credentials. No specific brand impersonation has been confirmed, but the infrastructure aligns with generic credential theft operations. Analysis of pmump.fun reveals multiple technical indicators of malicious activity. The domain was flagged by 3 of 95 security vendors on VirusTotal, indicating low but detectable detection coverage. It was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026, with a creation date suggesting recent deployment for phishing purposes. The domain resolved to IP address 172.67.193.143, a hosting provider commonly associated with malicious infrastructure. It appears on 2 security blocklists and was referenced in 1 threat intelligence pulse on AlienVault OTX. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy to potential victims. Gridinsoft assigned a trust score of 0/100, reinforcing the domain's high-risk classification. Current status indicates pmump.fun has been taken offline, likely due to enforcement actions or infrastructure changes by the threat actor. However, the domain remains a viable indicator of compromise for retrospective analysis. Organizations are advised to block the domain and its associated IP address at the perimeter level. Security teams should review logs for connections to 172.67.193.143 or any subdomains of pmump.fun to identify potential credential exposure. Endpoint protection systems should be updated to include this domain in phishing detection rules. Given the domain's recent creation and low detection rate, proactive monitoring for similar domains registered through the same registrar is recommended to mitigate future threats.