xn--pmp-e1a[.]fun

Analysis of xn--pmp-e1a.fun, registered through Dynadot on 26 February 2026, shows the domain is actively leveraged for phishing. The site resolves to 104.21.10.202, an IP owned by Cloudflare (AS13335) located in the United States. DNS resolution uses Cloudflare’s authoritative nameservers dina.ns.cloudflare.com and guy.ns.cloudflare.com, and the service presents an HTTP/3 endpoint protected by a Let’s Encrypt certificate (issued by “E7”). The only observed HTTP response is a 522 “Connection timed out” page title, indicating the backend server is currently unreachable, consistent with the reported offline status.

Threat intelligence feeds have listed the domain on three independent blocklists, and it is explicitly blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans show three of ninety‑three security vendors flag the domain, reinforcing the malicious classification. The combination of recent registration, use of reputable CDN infrastructure, and presence on multiple anti‑phishing lists suggests a deliberate attempt to hide phishing payloads behind trusted network edges.

While the exact phishing kit, target brand, or lure content has not been captured, the evidence base is sufficient to treat the domain as a confirmed phishing infrastructure. Defenders should add 104.21.10.202 to network deny lists, enforce DNS sink‑hole rules for xn--pmp-e1a.fun, and monitor Cloudflare‑hosted IP ranges for similar rapid‑registration patterns. Continuous re‑scanning of the domain on VirusTotal and inclusion in internal URL filtering policies are recommended to mitigate potential re‑activation.