puump[.]sbs

This domain, puump.sbs, is identified as a crypto drainer phishing site designed to compromise digital wallet credentials and drain cryptocurrency assets. Analysis indicates the domain employs malicious JavaScript payloads to intercept and exfiltrate sensitive wallet data, including private keys and seed phrases, upon user interaction. The infrastructure is optimized for rapid deployment and evasion, leveraging generic page titles such as 'Pump' to avoid immediate detection while maintaining functionality for credential harvesting operations. Technical evidence confirms the domain's malicious intent through multiple indicators. VirusTotal reports 16 out of 95 security vendors flagging puump.sbs as malicious, while it appears on five distinct security blocklists. The domain was registered on June 08, 2024, through NameSilo, LLC, a registrar frequently associated with phishing infrastructure. Infrastructure analysis reveals the domain resolves to the IP address 188.114.96.3, which has been linked to other phishing campaigns in recent threat intelligence pulses. AlienVault OTX records two pulses referencing this domain, further corroborating its association with active phishing operations. The domain's trust score of 0/100 on Gridinsoft underscores its high-risk classification. Users who visited puump.sbs or interacted with its content should assume potential compromise of wallet credentials. Immediate actions include revoking access to any connected wallets, transferring remaining assets to a new secure wallet, and conducting a full system scan for malware. Monitor transaction histories for unauthorized activity and report any suspicious transactions to the relevant blockchain explorer or wallet provider. If credentials were entered, consider all associated accounts as compromised and update passwords or recovery phrases for any linked services. Security teams should add the domain and its resolving IP to internal blocklists to prevent further exposure.