Is pumpfunsolstreamer.xyz a scam? TrustSniffer's high-risk assessment: 1/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This is a newly launched website on the low-cost .xyz extension. It presents a single landing page titled "Pump", and its domain name combines "pump", "fun", "sol" and "streamer" wording that evokes the Solana crypto-token ecosystem. No substantive product, service or business description could be extracted from the captured page, so its commercial purpose is inferred only from the domain name and page title.

Scam/Impersonation Risk

This site presents a serious and confirmed reputational threat that outweighs everything else in the evidence. Several top-tier security vendors independently classify the domain as malicious, with further vendors rating it suspicious. The domain is therefore blacklisted by external threat-intelligence sources, and a prior phishing association is also recorded for it. The strength of these detections triggered an automatic safeguard that caps the trust outcome at its lowest tier, regardless of any positive technical attributes. No conflicting legal identities and no confirmed brand-impersonation finding were recorded. The cautionary assessment rests on the blacklisting and the phishing association, not on an identity contradiction. A domain name that echoes a popular crypto-platform brand and sits beside a hosting profile typical of throwaway campaigns is consistent with the pattern of token-themed lure sites. That pattern is a risk indicator here, not an established finding of impersonation. Sandbox sessions observed no outbound data transfers and no wallet-connection attempts, but the sessions were brief and cannot rule out later changes to the page. Evidence:

• Homepage: 13 malicious and 2 suspicious verdicts from external security engines, including three tier-one vendors, and a recorded prior phishing association.
• Domain registered 2026-08-28 (~0.16 years old), only weeks before the threat detections.
• Web archive holds 4 snapshots spanning 2026-09-05 to 2026-10-12 (1 year tracked), consistent with a very young, thinly documented site.
• Homepage behaviour: 3 of 3 sandbox runs completed with no external network calls or wallet interaction, and 18 console errors were logged.

Regulatory Verification Notes

The evidence offers no basis for treating the site as a licensed or regulated financial business. The analysis found no regulatory registration, and no third-party regulatory or broker-database match exists for the name. Ownership is opaque: the registrant record is incomplete, and the real-world operator could not be connected to any identifiable person or company. That opacity reflects on governance and is not an identity contradiction. A site that invites crypto-themed interaction while giving no operator details and no regulatory status offers a visitor no recourse if funds are lost. The site's valid encryption does not change this assessment, because it only secures the connection and says nothing about the operator's identity or licensing. Evidence:

• Registered through Global Domain Group LLC; registration created 2026-08-28 and set to expire 2027-08-28.
• Served from AS13335 (Cloudflare, US); TLS certificate issued by WE1 (DV, domain-validated only), valid to 2026-11-26 with 31 days remaining.
• Homepage: titled "Pump", with no operator, company or licensing details recorded in the captured content.
• No match for the name in the broker-reputation dataset.

What to Verify Next

Verification here is mainly about confirming that the site should be avoided, not about qualifying it for use. Anyone who arrived through a social post, stream, message or advertisement should trace the link back to the platform's officially published channels, not the page that was reached. Official project accounts and documentation should be checked for any reference to this exact domain. Any claimed operator should be checked against the relevant financial-services or company registry through an independent route. If the domain was received in a message, the sender should be asked, through an unrelated channel, whether they actually sent it. Official support and contact channels should be confirmed through that same independent route. Evidence:

• Domain registered in the weeks before the analysis, with no lasting public history to cross-reference.
• Homepage carries no verifiable operator identity to check against a registry.
• Multiple external security engines currently flag the domain, so any link to it should be treated as untrusted until those listings are cleared.

Summary Verdict

The site carries an elevated, high-severity risk posture, driven decisively by confirmed external threat detections that no technical hygiene can offset. It is a very young domain with unverified ownership and no established reputation. Its legitimacy cannot be supported on the available evidence, and sensitive interaction of any kind is unsafe.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and web application firewall, and every observed address is a Cloudflare edge server. The underlying origin host could not be independently identified. Sandbox testing also detected Cloudflare bot protection and no content cloaking. This infrastructure is a mitigating factor only. It is widely used, including by short-lived sites, so it confers no legitimacy. Because only the edge is visible, the hosted content could be swapped quickly without any change to the network profile. A heuristic flag for a young domain with sparse subdomains is unconfirmed and carried little weight.

Closing Assessment

The site should be treated as unsafe for any login, credential entry, wallet connection or financial transaction. At most, it should be viewed passively, and nothing should be downloaded from it. Anyone who has already entered credentials or connected a wallet should change the affected passwords and revoke wallet permissions immediately. Any suspicious link that led here should be reported to the platform where it was found.