pump-stream[.]live

Analysis classifies pump-stream.live as a high-risk credential theft domain. The observed behavior and threat profile are consistent with infrastructure used to capture account credentials through deceptive web content and fraudulent login workflows. Because the domain remains active, exposure risk is ongoing. The absence of an SSL certificate increases concern regarding insecure data collection and suggests limited effort to establish legitimate trust signals. Users interacting with pages hosted on this domain may be exposed to credential harvesting attempts, account compromise, unauthorized access events, and follow-on abuse involving stolen authentication data.

Infrastructure review identifies the domain as active and associated with a high-risk assessment. VirusTotal detections show 5 out of 95 security vendors flagging the domain. Registration records indicate creation on May 24, 2026, through Global Domain Group LLC. DNS resolution maps the domain to IP address 188.114.96.3. Hosting infrastructure is geolocated in the US and associated with AS13335. The domain currently has no SSL certificate present. Intelligence sources indicate inclusion on 3 separate security blocklists. External defensive monitoring has resulted in blocking actions by multiple security organizations. The combination of recent registration, active status, lack of certificate deployment, blocklist presence, and confirmed security detections materially elevates the likelihood of malicious use.

Mitigation should focus on credential theft prevention. Access to the domain should be blocked at network, DNS, email, proxy, and endpoint control layers. Any user who visited the domain should immediately reset potentially exposed passwords, invalidate active sessions, review account access logs, and enable multi-factor authentication where available. Security teams should inspect authentication events for anomalous logins, monitor for credential reuse attempts, and search logs for connections to pump-stream.live and IP 188.114.96.3. Organizations should maintain blocklist coverage, alert on future contact with this infrastructure, and treat submitted credentials as potentially compromised until verified otherwise.