xn--pump-f1a[.]fun

PhishDestroy has identified xn--pump-f1a.fun as a generic phishing domain designed to impersonate the popular crypto platform Pump.fun. This domain is currently offline, but during its active period it posed a significant threat to cryptocurrency users by attempting to drain their wallets. The domain was created on March 07, 2026, and registered through Dynadot LLC, a registrar sometimes abused by malicious actors. It resolves to IP address 172.67.164.28, which is associated with Cloudflare, a common service used to mask hosting locations.

According to intelligence gathered, xn--pump-f1a.fun was flagged by 2 out of 95 security vendors on VirusTotal, and it appeared on 3 security blocklists. The page title was simply "pump," which aligns with the impersonation of Pump.fun. No SSL certificate was detected, meaning any data transmitted to the site would be unencrypted and vulnerable to interception. The domain's trust score is low, and its registration details suggest it was set up specifically for malicious purposes.

Although the domain is now offline, users should remain vigilant. PhishDestroy recommends that anyone who may have interacted with xn--pump-f1a.fun check their crypto wallets for unauthorized transactions and enable two-factor authentication. Always verify domain names carefully, especially those using internationalized characters like the punycode in this domain. For ongoing protection, use PhishDestroy's browser extension to block known phishing sites and report any suspicious domains.