xn--ptmp-w7a[.]fun

Analysis indicates that the punycode domain xn--ptmp-w7a.fun was registered on March 04, 2026 through Dynadot LLC. DNS resolves to the IP address 188.114.97.3, which is part of Cloudflare’s AS13335 network located in the United States. The domain is served behind Cloudflare, with observed technologies including Cloudflare Browser Insights and HTTP/3 support. An active TLS certificate issued by Let’s Encrypt (certificate identifier E8) was present at the time of collection, confirming that the site offered HTTPS connectivity. The page title returned by the web server was simply “pump”, and no additional content was captured before the site was taken offline.

Security telemetry shows the domain appears on three blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL. The Gridinsoft trust scoring system assigned a score of 0 out of 100, indicating an extremely low confidence in legitimacy. VirusTotal analysis recorded detections from two of ninety‑four scanned vendors, reinforcing the malicious classification. The combination of a recent registration, low trust score, presence on multiple blocklists, and the “pump” title aligns with the generic phishing categorization supplied in the threat feed.

Uncertainty remains regarding the specific payload, target audience, or any credential‑harvesting mechanisms because the site was offline before a full content scrape could be performed. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑use of the associated IP address or Cloudflare namespace, and update local allow‑lists only after a thorough re‑assessment. Observers should also note the use of Cloudflare’s infrastructure, which can obscure the ultimate hosting location, and consider that the domain may be re‑registered or used in future campaigns. Ongoing vigilance is recommended.