funpumpofficial[.]web[.]app

This domain, funpumpofficial.web.app, is flagged as a high-risk brand impersonation threat targeting Pump.fun, a decentralized application platform. Analysis indicates the domain mimics the legitimate Pump.fun interface, likely to deceive users into disclosing credentials or interacting with malicious smart contracts. The page title explicitly replicates the legitimate site, reinforcing the impersonation attempt. No specific drainer kit signatures have been confirmed at this stage, but the domain exhibits characteristics consistent with credential harvesting or token theft operations.

Infrastructure analysis reveals the domain resolves to IP address 199.36.158.100, hosted under Google LLC (Firebase) infrastructure. The domain was registered on February 21, 2026, and is currently flagged by 1 out of 95 security vendors on VirusTotal. It appears on 2 security blocklists, including PhishDestroy and ScamSniffer. The SSL certificate is issued by Google Trust Services (WR4), and the domain remains unresolved by Google Safe Browsing at the time of this report. The hosting provider, Google LLC, is a common choice for threat actors due to its low-cost, scalable infrastructure.

As of the latest assessment, funpumpofficial.web.app remains active and unresolved by major browser-based protections. Immediate response actions include submission to additional threat intelligence feeds and coordination with the hosting provider for takedown. Despite existing detections, the domain poses a residual risk due to its active status and potential for rapid redeployment under alternative subdomains or IPs. Users are advised to verify domain authenticity via official channels and avoid interacting with any unsolicited links or prompts associated with Pump.fun branding.