pxmp[.]fun

This domain, pxmp.fun, is flagged as an elevated-risk cryptocurrency drainer phishing site designed to illicitly extract digital assets from victim wallets. Analysis indicates the infrastructure is specifically engineered to mimic legitimate cryptocurrency platforms, tricking users into authorizing malicious transactions that drain funds. The threat type is highly targeted, leveraging social engineering to exploit wallet permissions, a tactic increasingly observed in crypto-focused phishing campaigns. Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain resolves to the IP address 172.67.215.194, a host frequently associated with malicious activity. It was registered through Spaceship, Inc. on February 26, 2026, an unusually future-dated registration that may indicate an attempt to evade detection or establish long-term malicious operations. Security vendors on VirusTotal flagged the domain at a rate of 2/95, a low but notable detection ratio suggesting early-stage or evasive malicious behavior. The domain appears on three security blocklists, including PhishDestroy, ScamSniffer, and Maltrail, further corroborating its malicious intent. The page title, 'Pump,' aligns with common cryptocurrency scam themes, often used to create a false sense of urgency or opportunity. Mitigation against cryptocurrency drainer threats requires a multi-layered approach. Users should immediately revoke any suspicious wallet authorizations linked to pxmp.fun or similar domains via their wallet’s connected apps interface. Enabling transaction simulation tools can help preview the outcome of smart contract interactions before execution. Organizations and individuals should block the domain and its associated IP (172.67.215.194) at the network level to prevent access. Wallet providers are advised to monitor for interactions with this domain and proactively warn users attempting to connect. Given the domain’s current offline status, continuous monitoring for reactivation or migration to new infrastructure is critical, as threat actors often re-establish operations under altered domains or IPs.