ethpumper[.]xyz

Analysis of ethpumper.xyz, created on 21 February 2026, shows a high‑risk crypto‑focused phishing campaign that remains active as of 23 July 2026. The site resolves to IP 188.114.96.3, which is owned by Cloudflare, Inc. (ASN 13335) and is geolocated in the United States. The domain is served behind Cloudflare’s edge network, using Cloudflare Browser Insights and HTTP/3, and is protected by an SSL certificate issued by Google Trust Services under the WE1 identifier. DNS is delegated to cameron.ns.cloudflare.com and naomi.ns.cloudflare.com, and the registrar record lists NiceNIC International Group Co., Limited as the registrar. A request to the site returns HTTP 403, and the only visible page title is “Just a moment…”.

VirusTotal has recorded three detections out of ninety‑three scanning engines, indicating that at least a subset of security tools have identified malicious behavior. The domain is currently listed on one public blocklist and is flagged by PhishDestroy. The trust score reported by Gridinsoft is zero out of one hundred, reinforcing the suspicion of fraudulent use. The intelligence indicates a crypto scam pattern, but the exact payload, credential‑stealing forms, or malicious redirects have not been observed publicly.

Consequently, the precise tactics, techniques, and procedures (TTPs) remain partially unknown. Defenders should block both the domain and its underlying IP at perimeter and DNS layers, enforce TLS inspection where possible, and monitor outbound connections to Cloudflare‑hosted assets that lack legitimate business justification. Continuous re‑scanning with multi‑engine services is advised to capture any emerging detections. Threat‑intel feeds should be updated to include ethpumper.xyz to improve near‑real‑time detection across security controls.