punpfun[.]sbs

On July 29, 2026, the domain punpfun.sbs was observed in active malicious activity classified as generic phishing. The domain currently appears on four independent security blocklists and is explicitly blocked by the PhishDestroy, MetaMask, ScamSniffer, and SEAL filtering platforms. VirusTotal analysis shows that fifteen of ninety‑one AV and URL‑reputation engines return a positive detection for the domain, indicating a consensus of malicious intent across multiple vendors.

The threat rating assigned by internal scoring mechanisms is high, reflecting the combination of blocklist presence and multi‑vendor detections. Infrastructure details such as registrar information, registration date, ASN, hosting IP address, SSL certificate parameters, HTTP response codes, and Safe Browsing status have not been publicly disclosed or are pending further investigation. The page title retrieved from the site has not been captured, and no additional evidence links (e.g., OTX pulse IDs) are presently available.

Given the confirmed presence on reputable blocklists and the cross‑vendor detection rate, defenders should immediately add punpfun.sbs to deny‑list rules across web proxies, DNS filtering services, and endpoint security suites. Continuous monitoring of the domain’s resolution and any future changes in detection counts is advised. Organizations employing phishing‑resistant authentication should verify that any credential‑submission attempts to this domain are blocked, and security teams should consider sharing any new artifacts with the broader threat‑intel community to accelerate collective mitigation.