pumpmonster[.]fun

PhishDestroy identifies pumpmonster.fun as an active cryptocurrency drainer kit distribution domain, likely targeting unsuspecting users with fake token offers or deceptive airdrops. The site mimics legitimate crypto platforms to siphon funds via malicious JavaScript payloads designed to drain connected wallets. While no specific brand is directly spoofed at this stage, the infrastructure and operational patterns align with known cryptocurrency phishing campaigns leveraging social engineering tactics. The domain’s registration and hosting choices suggest a deliberate attempt to blend into the decentralized web ecosystem, complicating early detection. This domain was flagged during routine threat hunting with a VirusTotal score of 2/95 detections, indicating it remains under the radar of most security vendors. It resolves to IP 193.233.82.208 and is registered through Dynadot Inc, with a creation date of April 18, 2026. The SSL certificate, issued by Let’s Encrypt, adds a veneer of legitimacy, a common tactic to evade browser-based warnings. Google Safe Browsing (GSB) has not yet flagged the domain, and no blocklist entries are currently recorded across major threat intelligence feeds. The recent registration and clean record could indicate a newly deployed threat actor asset poised for rapid deployment in targeted campaigns. As of this advisory, pumpmonster.fun remains active with no active takedown or mitigation in place. SOC teams are advised to immediately add the domain and its resolving IP to network and endpoint blocklists. Users should avoid interacting with the domain and report any related incidents to their security teams. The current risk remains high due to the active status and lack of vendor detections, though attribution and campaign scope are still under investigation. Proactive hunting for related infrastructure and campaign artifacts is strongly recommended to prevent further compromise.