fees-pumps[.]fun

The domain fees-pumps.fun has been identified as a high-risk phishing domain, primarily due to its association with deceptive practices aimed at extracting sensitive information from unsuspecting users. The domain's page title 'pump · cashback' suggests it may impersonate legitimate financial services or cashback schemes. However, no specific brand or drainer kit has been explicitly linked to this domain.

Technical analysis of fees-pumps.fun reveals several critical threat indicators. VirusTotal reports that 16 out of 95 security vendors have flagged this domain as malicious. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar often scrutinized for hosting suspicious domains. The IP address 104.21.0.83 is associated with the domain, which is currently offline. The domain's SSL certificate was issued by Google Trust Services. Additionally, fees-pumps.fun appears on four security blocklists and has been included in two threat intelligence pulses on AlienVault OTX, further confirming its malicious nature.

The current status of the domain is offline, reducing the immediate threat it poses. However, its previous presence on multiple blocklists and its detection by various security vendors highlight the importance of continuous monitoring. Users and organizations are advised to maintain updated security measures to protect against similar threats. The domain's removal from service indicates a successful initial response, but vigilance is necessary to mitigate any residual risks or potential reactivation under a different guise.