shares-sunpump[.]com

PhishDestroy has flagged shares-sunpump.com as an active generic phishing domain designed to impersonate a cryptocurrency investment platform and harvest user credentials or crypto wallet access. The domain does not align with any legitimate brand or service, suggesting a fraudulent operation aimed at unsuspecting investors. Based on available telemetry, this appears to be a drainer kit deployment, likely targeting users through social media ads or spoofed email campaigns claiming high-yield investment opportunities.

This domain was registered on April 14, 2026 via NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to IP address 188.114.96.3. It is currently secured with a Let's Encrypt SSL certificate to appear legitimate. Despite being active and accessible, the domain has not been flagged by VirusTotal scanning solutions, showing 0 detections out of 95 engines as of initial triage. It remains unlisted in Google Safe Browsing databases and has not been widely blocklisted, increasing its potential reach and hazard to users.

While the immediate risk is classified as under investigation, shares-sunpump.com remains active and poses an evolving threat to cryptocurrency users. PhishDestroy recommends users avoid interacting with the domain and organizations monitor for connections to 188.114.96.3 or the registered domain. Organizations are advised to update blocklists, scan endpoints for IOCs, and educate users on recognizing fraudulent investment schemes. Remaining risk is moderate due to low detection and fresh registration, enabling opportunistic exploitation.