pumpxchange[.]wixstudio[.]com

The domain pumpxchange.wixstudio.com has been identified as a fraudulent crypto exchange platform impersonating PumpSwap, a legitimate cryptocurrency trading service. Analysis indicates this site is designed to deceive users into depositing digital assets under the pretense of trading, likely functioning as a crypto drainer to siphon funds. The domain is currently offline, though prior activity suggests it was actively targeting unsuspecting victims seeking PumpSwap services.

Infrastructure analysis reveals the domain resolves to the IP address 34.144.206.118 and is secured with a Let's Encrypt SSL certificate, a common tactic to appear legitimate. The domain was registered through GoDaddy.com, LLC on December 17, 2016, though its malicious use appears to be recent. Security vendors have flagged this domain, with 4 out of 95 VirusTotal engines detecting it as malicious. Additionally, it appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD. The page title, PumpSwap® Exchange™, directly mimics the branding of the legitimate PumpSwap platform, reinforcing its deceptive intent.

Given the domain's current offline status, it may be undergoing maintenance or evasion tactics to avoid detection. However, the existing indicators—such as the blocklist presence, VirusTotal detections, and brand impersonation—confirm its malicious nature. Users are strongly advised to avoid interacting with this domain or any associated links. Organizations should update security filters to block the domain and IP address, monitor for similar impersonation attempts, and educate users on verifying legitimate crypto exchange platforms before engaging in transactions.