worldpumpfun[.]xyz

This domain, worldpumpfun.xyz, is flagged as a high-risk phishing site specializing in fake wallet drainer activity. Analysis indicates the site impersonates legitimate cryptocurrency wallet interfaces to trick users into entering private keys or seed phrases, enabling unauthorized fund transfers. No specific brand impersonation has been confirmed, but the site employs common drainer kit techniques such as fake transaction prompts and simulated wallet connections. The infrastructure appears designed to harvest sensitive credentials with minimal detection during initial deployment. Technical indicators confirm the domain was registered on June 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. It currently resolves to IP address 172.67.129.110, which hosts multiple other suspicious domains. VirusTotal reports a detection rate of 1 out of 95 security vendors, suggesting low initial detection but growing awareness. No Google Safe Browsing (GSB) flags are present at this time, and the domain remains absent from major blocklists, though monitoring systems have observed recent increases in referral traffic from compromised social media links. The domain remains active as of the latest verification, with no takedown requests or sinkholing detected. Response actions include submission to additional threat intelligence platforms and monitoring for changes in resolution or content patterns. Despite the low initial detection rate, the high-risk classification persists due to the domain's clear intent to facilitate financial theft. Users are advised to block resolution at the network level and report any observed phishing attempts to relevant financial security teams. Organizations should update endpoint protection rules to include this domain and its associated IP in deny lists to prevent credential harvesting incidents.