# refund-pumps.fun — SUSPICIOUS

> PhishDestroy monitors refund-pumps.fun, a newly registered domain under investigation for phishing. Learn what users should know to stay safe.

## Summary
PhishDestroy identifies refund-pumps.fun as a domain associated with generic phishing activity, posing potential risks to users through deceptive tactics aimed at stealing sensitive information. Although the exact threat vector remains under investigation, such phishing campaigns can lead to financial loss and privacy breaches, highlighting the importance of early detection and caution.

The domain refund-pumps.fun was registered recently on March 4, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to IP address 104.21.69.36. Despite a clean scan from VirusTotal with zero detections across 95 security vendors, its recent creation date and suspicious registrar profile contribute to its under-investigation status. No current vendor flags exist, but the infrastructure details warrant vigilance.

Users are advised to exercise caution when encountering communications or links referencing refund-pumps.fun, avoiding interaction or disclosure of personal data. Employing updated security tools and verifying URLs before engagement remain critical defenses. PhishDestroy continues to monitor this domain closely and recommends reporting any suspicious activity linked to it.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: dead (HTTP 403)
- Page title: Just a moment...

## Domain Intelligence
- Registered: 2026-03-05 09:07:01
- Registrar: NiceNIC International Group Co., Limited
- Country: HK
- IP: 104.21.69.36
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: maya.ns.cloudflare.com rustam.ns.cloudflare.com
- SSL Issuer: none

## Detection Status
- VirusTotal: 2 vendors flagged
  Vendors: ["Fortinet", "SOCRadar"]
- Google Safe Browsing: clean
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "MetaMask", "SEAL"]

## Evidence
- Screenshot: https://i.ibb.co/QFpvthCK/fd1f826bfa61.png
- Cloudflare Radar: https://radar.cloudflare.com/domains/refund-pumps.fun
- Wayback Machine: https://web.archive.org/web/https://refund-pumps.fun
- PhishDestroy: https://phishdestroy.io/domain/refund-pumps.fun/
- LLM endpoint: https://phishdestroy.io/domain/refund-pumps.fun/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/refund-pumps.fun/
Last updated: 2026-03-19