Is ipumpi.xyz a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The domain ipumpi.xyz is a very recently registered website on the .xyz top-level domain. During automated visits, its homepage was replaced by an edge-security interstitial titled as a suspected-phishing warning, so the site's own products, branding and business model could not be observed. Its apparent purpose therefore cannot be established from the page itself. The behaviour of the site and the reputation signals attached to it are the only available basis for assessment.

Scam/Impersonation Risk

This site carries a confirmed adverse reputation. A substantial number of independent security engines currently flag the domain as malicious, including several tier-one security vendors. It also appears on an external blacklist, which independently triggered the most restrictive risk classification. This is the decisive finding of the report, and the site's protective hosting and valid encryption cannot offset it. The page presented to visitors was itself a phishing-suspicion warning, which is consistent with those detections. No conflicting legal identities and no specific brand impersonation were identified, because the site's own content was never rendered. The risk therefore rests on the reputation evidence, not on observed page claims. No contact address was published or captured. Behavioural testing found no wallet-connection prompts, wallet-drainer behaviour, clipboard manipulation, hidden forms or credential posts to external destinations. These clean results do not outweigh the blacklist and detection evidence, because the page was gated and the real site content was not exercised. The very young domain age is typical of throwaway phishing infrastructure and compounds the concern. Evidence:

• Homepage: access was blocked with a 403 response and a bot-challenge page whose title reads as a suspected-phishing warning.
• Reputation: 15 malicious and 1 suspicious detections across the security-engine panel, including three tier-one vendors, plus an external blacklist hit.
• Domain provenance: registered 2026-08-12 (~0.2 years, about 74 days old); 52 web-archive snapshots, all in 2026 (1 year tracked).
• Homepage behaviour in three test runs: 25 external XHR requests and 9 external POSTs (none to non-whitelisted destinations), 20 console errors, and no wallet, clipboard or hidden-form activity.

Regulatory Verification Notes

No licence, registration number, legal entity name or regulator reference could be captured, because the homepage was gated by the interstitial. The operator's real-world identity is therefore unverified, and no third-party broker or regulatory record matched this domain. This is a verification gap and not, by itself, evidence of wrongdoing, but here it sits alongside confirmed adverse reputation signals. The registration record is incomplete as to the owner, so ownership is opaque. The domain was registered through Global Domain Group LLC and is set to run for about a year. The site uses a valid but entry-level domain-validated certificate. That certificate shows only that the connection is encrypted and that someone controlled the domain at issuance. It does not establish the identity or legitimacy of the operator. Evidence:

• Homepage: the visible text was only a security warning, with no company name, licence or legal-page content.
• Registration: registrar is Global Domain Group LLC; created 2026-08-12, expires 2027-08-12; owner details incomplete.
• Transport security: TLS certificate issued by WE1 (DV), valid to 2027-01-08.
• Hosting: served from AS13335 (Cloudflare, Inc., US).

What to Verify Next

Any prospective interaction should begin with independent confirmation that the intended counterparty actually operates this domain. That means checking the address against official channels published by the organisation, such as its verified social profiles, regulator registers or printed materials. Because no business name or licence was visible, a claimed entity must be checked directly with the relevant financial or consumer-protection registry before any engagement. If the domain reached a user through a message, advertisement or social post, that link should be treated as untrusted and the original sender confirmed through a separate, offline route. Security teams may wish to retest after the warning page is lifted, but the current detections should be assumed valid until independently cleared. Evidence:

• Homepage: no operator identity or contact channel was observable to verify against.
• Reputation: current malicious detections and a blacklist listing remain unresolved.
• Domain age: registration is under three months old, so no long-term operating record exists to corroborate any claimed identity.

Summary Verdict

The overall posture is high-risk. Strong, converging external threat detections and a blacklist listing, combined with a brand-new domain and an unverified operator, outweigh the few neutral technical positives observed. The site does not read as an established, legitimate entity. The assessment rests on confirmed reputation evidence and not on speculation about the site's content.

Infrastructure Integrity

The site sits entirely behind Cloudflare's CDN and WAF, and every observed address is an edge node, so the true origin server could not be seen. This protection is a modest mitigating factor, since it shows ordinary hosting hygiene. The same edge-only visibility also prevents independent verification of where the content is hosted and can mask rapid content changes. It does not counter the reputation findings. Bot-protection behaviour was consistent with a standard challenge and not with deliberate content cloaking, and the domain's sparse subdomain footprint fits a newly deployed property.

Closing Assessment

The site should not be used for login, credential entry, payments or any financial interaction. Any link to it should be treated as untrusted and not opened further. Anyone who has already submitted credentials or funds should change those credentials immediately and contact their bank or platform.