xn--pnp-e1a[.]fun

The domain xn--pnp-e1a.fun has been identified as a potential phishing threat, specifically related to crypto-draining activities. The page title "Pump" suggests that it may have been used to lure users into fraudulent schemes likely related to cryptocurrency pumps. Currently, there is no indication of a specific brand being impersonated, but the domain’s configuration and deployment suggest malicious intent.

Technical analysis reveals significant indicators of compromise. The domain was flagged by 5 out of 95 security vendors on VirusTotal, indicating a substantial level of suspicion. It was registered through Dynadot LLC on March 02, 2026, and resolves to the IP address 188.114.97.3. Despite its offline status now, it appeared on four separate security blocklists, including MetaMask, PhishDestroy, SEAL, and Maltrail, which reflect its recognized threat level within the cybersecurity community. Moreover, the domain employed technologies like Let's Encrypt for SSL certification and utilized services such as Amazon Web Services and Google Analytics, which may have been leveraged to enhance the site's credibility and reach.

Currently, the domain is offline, mitigating its immediate threat. However, given its past behavior and associations, it remains a subject of interest for ongoing monitoring. Users are advised to avoid any interaction with this domain, and institutions should ensure it remains blocked on their networks to prevent any future phishing attempts. Continued vigilance and updates to threat intelligence feeds are recommended to stay ahead of potential domain resurrection or similar threats.