Is pumpfunstreams.xyz a scam? TrustSniffer's high-risk assessment: 1/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This is a newly registered .xyz website, titled simply "Pump", whose domain name pairs a crypto token-launch term with a streaming theme. Its apparent purpose is to attract visitors in the memecoin and token-launch niche. The homepage is served behind a bot-challenge gate, and the pages reviewed did not establish a clear product, operator or business model beyond the branding.

Scam/Impersonation Risk

Contradictory signals are present and decisive. Several major security vendors independently flag the domain as malicious, and the site is blacklisted by external reputation sources, which is a confirmed, serious negative. The domain is also very young, with almost no historical footprint, so there is no record of benign operation to offset the detections. Naming that echoes a popular token-launch platform is a pattern commonly used to attract crypto users to look-alike sites. The evidence reviewed does not confirm impersonation of a specific brand, but the combination of that naming, the detections and the lack of history is consistent with a disposable or abusive property. The sandbox visits did not observe wallet-connection prompts, clipboard manipulation, hidden forms or external data posts. These absences slightly narrow the observed attack surface but do not offset the confirmed detections, particularly because the page is gated and later content changes could introduce those behaviors. Evidence:

• Domain registered 2026-08-22 (~0.18 years old) through the registrar Global Domain Group LLC.
• Web archive holds only 2 snapshots, first captured 2026-08-31 and last 2026-10-11, all within one calendar year (2026).
• The homepage, tested over three sandbox runs, made no external requests, but it logged repeated script console errors.
• Multiple independent threat-intelligence detections remain active against the domain.

Regulatory Verification Notes

The reviewed pages establish no operating entity, jurisdiction, licence or registration number, and the operator's real-world identity is not independently established. For a site in the crypto and token-launch space, this is a material disclosure gap. It also removes any regulated-entity or complaint-handling recourse for a user who engages. No third-party broker or regulatory-database record was matched for the domain. That absence is neutral and is not a verdict on licensing status. The site's transport encryption confirms only that the connection is encrypted, not who runs the service. Evidence:

• The homepage, titled "Pump", presents no visible corporate name or registry reference in the content captured.
• Hosted on AS13335 (Cloudflare, Inc., US).
• TLS certificate issued by WE1 (DV, domain validation only), valid to 2027-01-18.

What to Verify Next

Any link to this domain should be checked against the official channels of the project or platform it appears to reference, and a link received through a message, advertisement or social post should be treated as unconfirmed. The operator's identity and any claimed regulatory standing should be checked through the relevant public registries, and official support or contact channels should be confirmed through an independent route rather than through the site itself. Until those checks succeed, no wallet connection, signature request, account creation or payment should be attempted. Evidence:

• The domain name pairs a well-known token-launch term with a streaming theme, so its link to any legitimate project is unconfirmed.
• The homepage is gated by a bot challenge, which limits independent inspection of what is offered after entry.
• The page title is a single generic word with no distinguishing brand statement.

Summary Verdict

The site carries a critical, high-risk trust posture. Confirmed external threat detections combined with a very young, thinly documented domain outweigh its valid encryption and ordinary hosting. The operator's identity remains unestablished, so there is no basis for treating the site as legitimate.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and all four observed addresses are edge servers, so the origin server is not observable. The hosting provider is reputable and the certificate is valid, which is mildly mitigating. Shared, reputable edge infrastructure does not vouch for the site's content and cannot offset the detections. The edge-only view also prevents independent verification of where the content is actually hosted. The domain's youth and sparse subdomain structure are unconfirmed heuristics and carry little weight beside the confirmed reputation findings.

Closing Assessment

The site should not be used for login, credential entry, wallet connection or any financial interaction. If it is opened at all, only passive viewing from an isolated browser is appropriate, and nothing should be downloaded from it. Users who have already interacted with it should revoke any wallet approvals, change reused passwords and report the domain to the platform it appeared to reference.