pumpcashbacks[.]fun

This domain, pumpcashbacks.fun, is identified as a high-risk brand impersonation scam targeting users of the decentralized platform Pump.fun. The site presents itself as an official cashback service, offering a fictitious 30% refund on losses under the page title 'Pump.fun Cashback - Get 30% Back on Your Losses.' The deceptive infrastructure mimics legitimate financial recovery schemes but lacks any affiliation with the genuine Pump.fun platform, indicating an intent to harvest user credentials or deploy cryptocurrency drainer scripts. Analysis indicates the domain was registered on March 07, 2026, through Global Domain Group LLC, a registrar frequently associated with fraudulent activities. It resolves to the IP address 172.67.128.133 and employs technologies such as Node.js, Vue.js, Nuxt.js, and Cloudflare, which are commonly used to obfuscate malicious operations. Google Safe Browsing flags the domain with a 'SOCIAL_ENGINEERING' classification, and it is currently blocked by five security blocklists, including MetaMask, PhishDestroy, and InversionDNS. VirusTotal reports 16 out of 95 security vendors detecting the domain as malicious, with a Gridinsoft trust score of 0/100. The domain has been taken offline, reducing immediate exposure to potential victims. However, the infrastructure remains a residual risk, as threat actors may repurpose the domain or migrate the scam to new addresses. Users who interacted with the site are advised to revoke any connected wallet permissions, monitor accounts for unauthorized transactions, and verify the legitimacy of any financial recovery offers through official channels. The use of Cloudflare and other obfuscation techniques suggests the operators may relaunch similar campaigns, warranting continued vigilance.