pumamy[.]cheap

The domain pumamy.cheap was registered on March 11, 2026 through Name.com, Inc. and is currently listed as offline. DNS resolution points to the IP address 34.96.206.232, which belongs to AS396982 Google LLC and is geolocated in Hong Kong. The domain uses four Name.com‑provided nameservers (ns4cjp.name.com, ns2cqs.name.com, ns1cnb.name.com, ns3cna.name.com) and presents an SSL certificate issued by Let’s Encrypt (R13). A simple HTTP request returned the page title "Mall," but no further content analysis is available.

The site appears on a single security blocklist and has been explicitly blocked by PhishDestroy. VirusTotal records show that 10 of 94 scanning engines flagged the domain, indicating a moderate level of detection across the security community. The combination of recent registration, Google‑hosted infrastructure, and TLS provisioning suggests a low‑cost, fast‑deployment phishing operation, consistent with the generic phishing classification.

Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms employed, as no page content or URL path details have been disclosed. Defenders should continue to monitor DNS queries for pumamy.cheap, enforce blocklist updates that include the domain, and consider adding the IP address 34.96.206.232 to network‑level deny lists, especially for traffic originating from or destined to Hong Kong. Ongoing collection of threat intel, such as sandbox execution of any retrieved page snapshots, would help clarify the exact malicious behavior and improve detection rules for similar infrastructure.