13pump[.]fun

This domain is flagged for elevated-risk brand impersonation targeting Curve, a financial services platform. The site mimics legitimate Curve branding to deceive users into disclosing sensitive account credentials or authorizing fraudulent transactions, likely through fake login portals or cryptocurrency drainer scripts embedded in the page content. The page title 'Pump' suggests an attempt to manipulate perceived urgency or investment opportunities, a common tactic in financial phishing campaigns. Analysis indicates the domain 13pump.fun was registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolved to the IP address 104.21.18.108, a Cloudflare-associated address often used to mask hosting infrastructure. Security vendors on VirusTotal flagged the domain at a rate of 7/95, while Gridinsoft assigned a trust score of 0/100. The domain appears on at least one security blocklist and was previously blocked by PhishDestroy. The creation date discrepancy (future-dated) may indicate an attempt to evade detection or exploit registration system anomalies. Mitigation steps for this brand impersonation threat include immediate blacklisting of the domain and its associated IP across all network security controls. Organizations should monitor for references to 13pump.fun in web traffic logs, particularly from users accessing Curve-related services. End users should be alerted to verify domain authenticity before entering credentials, especially if redirected from third-party links or search results. Security teams are advised to review DNS records for similar domains registered through PDR Ltd. or resolving to 104.21.18.108, as these may represent additional attack infrastructure. Curve account holders should enable multi-factor authentication and report any suspicious login attempts to the platform's fraud response team.