Is pumpfunlivestreams.xyz a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a recently registered .xyz domain whose name pairs a well-known crypto token-launch brand with "livestreams," suggesting a streaming or token-promotion front for retail crypto audiences. When analysed, its homepage did not present normal site content to a visitor. It returned an access-denied interstitial titled as a suspected phishing warning, with only a few hundred characters of text. Its apparent purpose and business model therefore cannot be established from what it publishes.

Scam/Impersonation Risk

Active contradictions are present, and the posture is high risk. Multiple major security vendors currently flag the domain as malicious, and the combined detections amount to a confirmed blacklist listing. Phishing-class intelligence is also associated with the domain. The homepage itself is gated behind a phishing-warning interstitial rather than ordinary content. The name borrows a recognisable crypto brand and attaches a generic "livestreams" label. That is a common lure pattern for fake giveaways, token promotions and wallet-connection traps, although no specific on-page brand impersonation could be confirmed because the content was not served. Behavioural testing found no wallet-connection prompts, clipboard manipulation, hidden forms, or password forms posting to external hosts. That is a mitigating observation only, and it does not offset the external detections. Page behaviour was still irregular: nearly all network activity went to external destinations, with dozens of background requests and several external data submissions. The page produced repeated script errors and large DOM changes after interaction, which is consistent with heavily scripted or rapidly changing content. No identity contradiction between legal entities was observed, because no legal or identity pages were available to compare. Evidence:

• Homepage: served an access-denied response titled as a suspected phishing warning, with roughly 400 characters of text.
• Reputation checks: 13 malicious and 2 suspicious verdicts among 92 engines, including three tier-one security vendors.
• Browser behaviour on the homepage: 67 external background requests, 8 external POST submissions, about 97% of activity directed externally, 20 console errors, and up to 1,523 DOM mutations after interaction.
• Domain registered 2026-08-14 (~0.2 years, 73 days old), so there is no established history to counterbalance the detections.

Regulatory Verification Notes

No legal, terms, privacy or about pages could be examined. The site therefore offers no company name, licence, registration number, or jurisdiction, and the on-page disclosure position is unclear rather than affirmatively adverse. Ownership details are incomplete in the registration record, which is ownership opacity and not an identity contradiction. This pattern is relevant because any crypto trading, staking or giveaway offer would normally require visible operator and licensing disclosures. No third-party broker or regulatory-database entry matches this domain, so there is no external regulatory standing to rely on. Evidence:

• Registrar of record is Global Domain Group LLC; the domain expires 2027-08-14, a one-year initial registration term.
• Registrant details are incomplete or withheld in the registration record.
• Served from AS13335 (Cloudflare, Inc., US); TLS certificate issued by WE1 (DV, domain validation only), valid to 2027-01-12. This confirms encryption but says nothing about operator identity.
• No licence, registration or entity disclosure was observable on the homepage content that was served.

What to Verify Next

Before any interaction, the domain should be checked independently against the official channels of the crypto brand it evokes. That means a brand-owned website or verified social account, not links found on this domain or in messages. Anyone who arrived through a social post, livestream, direct message or advertisement should treat that referral as unverified and trace it to its source. Any claimed licence or operating entity must be confirmed directly with the relevant registry before relying on it. If the domain is used by an organisation the user knows, its official support channels should be confirmed through an independent, offline route. Users who already connected a wallet or entered credentials should revoke token approvals and rotate passwords from a clean device. Evidence:

• Homepage: no official brand ownership statement or verifiable link to the brand's own channels could be observed.
• Domain age: the domain is roughly ten weeks old, so it cannot have an independent track record.
• Reputation: current malicious verdicts mean any claimed affiliation should be treated as unconfirmed.

Summary Verdict

The assessment is a clearly cautionary, high-risk posture. The domain is very new and lacks verifiable operator identity. It is currently flagged by several independent security sources and shows irregular page behaviour. These signals converge on a site that has not earned trust and that carries a meaningful threat to users who engage with it.

Infrastructure Integrity

The site is fronted by Cloudflare's CDN and WAF, and all four observed addresses are Cloudflare edge servers, so the true origin server could not be observed. Bot-challenge protection is active, and the domain has a valid TLS certificate from a recognised issuer. These are mitigating factors only. They show the site is behind mainstream infrastructure, but they do not demonstrate legitimacy. The edge-only view also prevents independent hosting verification. Protective infrastructure cannot offset the external threat detections.

Closing Assessment

The site should not be used for login, credential entry, wallet connection, payments or any financial action, and nothing should be downloaded from it. Access should be limited to passive viewing from a protected environment, if it is needed at all. Anyone who has already interacted with it should treat that activity as potentially compromised and report the link to the platform where it was found.