trollusdcpump[.]fun

The domain trollusdcpump.fun was registered on May 24, 2026 through Name.com, Inc. and is actively hosting a page titled “TROLL — Uncontrolled Supply Degen Coin ($TROLLUSDC)”. The page directly imitates the visual branding of Pump.fun, indicating a deliberate brand‑impersonation campaign aimed at deceiving users of the legitimate service. The domain resolves to the IPv4 address 185.158.133.1, which is geolocated to Germany (DE, DET FRA). The presence of a Google Trust Services / WE1 SSL certificate provides a false sense of legitimacy, while the HTTP response code of 200 confirms the site is serving content without redirection or error.

Infrastructure analysis shows the domain is listed on three security blocklists, including PhishDestroy, MetaMask, and SEAL, demonstrating that multiple threat‑intelligence sources have already flagged it. VirusTotal scans have resulted in 2 of 95 security vendors marking the domain as malicious, reinforcing the suspicion raised by other indicators. The domain’s nameserver configuration consists of four unique name servers (ns1hwy.name.com, ns2fln.name.com, ns3fqs.name.com, ns4jnz.name.com), a pattern commonly observed in rapidly deployed phishing infrastructure. Additionally, Gridinsoft assigns a trust score of 0 out of 100, underscoring the lack of any reputation or benign activity.

While the available data confirms active impersonation of Pump.fun and a high‑risk classification, the full scope of the campaign—such as the malware payload, victim targeting, or command‑and‑control infrastructure—remains undefined. Defenders should immediately block trollusdcpump.fun at network perimeter and DNS layers, update detection signatures to include the observed page title and SSL certificate details, and monitor for any related domains using the same nameserver patterns. Continuous re‑evaluation of VirusTotal and blocklist entries is advised to capture any escalation in vendor detections or additional indicators of compromise.