pump-streamchats[.]fun

This domain is classified as a high-risk cryptocurrency phishing threat. Analysis indicates it operates as a fraudulent interface designed to deceive users into disclosing wallet credentials, seed phrases, or private keys, leading to unauthorized asset transfers. The page title 'Pump' suggests an attempt to exploit trending cryptocurrency narratives, such as token pumps or airdrops, to lure victims. Infrastructure analysis reveals the following technical indicators: The domain pump-streamchats.fun is registered through Global Domain Group LLC and was created on May 16, 2026, indicating a recently established malicious infrastructure. It resolves to the IP address 188.114.96.3, hosted by CloudFlare, Inc. in Canada, which is a common tactic to obscure the true origin of the server. The domain appears on 3 security blocklists and is flagged by 3 out of 95 security vendors on VirusTotal. It uses a Let's Encrypt SSL certificate (serial number E8), which, while providing encryption, does not validate the legitimacy of the site. The domain is actively blocked by multiple security frameworks, including PhishDestroy, MetaMask, and SEAL. Mitigation steps for this specific threat type include immediate blocking of the domain and its associated IP address (188.114.96.3) at the network perimeter. Users should be advised to verify wallet addresses and transaction details independently before execution, particularly when interacting with domains promoting cryptocurrency-related offers. Organizations should monitor for connections to this IP and domain in network logs, as any interaction may indicate a compromised endpoint or an attempt to exfiltrate sensitive data. If credentials or private keys were entered on this domain, affected wallets should be considered compromised, and assets should be transferred to a new, secure wallet immediately. Security teams should also review DNS and proxy logs for additional indicators of compromise related to this infrastructure.