pumpfan[.]fun

Analysis indicates that pumpfan.fun is an active impersonation domain targeting Pump.fun, a platform associated with memecoin and crypto project discovery. The domain was registered on February 21, 2026, through NameCheap, Inc., and currently resolves to IP address 104.21.32.1, which is part of AS13335 (Cloudflare, Inc.) in the United States. The site is served via Cloudflare, utilizing technologies such as Google Analytics, Twitter Ads, and Cloudflare Browser Insights, which may facilitate tracking and ad-based monetization or malicious redirects. The page title, 'PumpList | Discover Trending Memecoins and Crypto Projects,' closely mirrors the branding and functionality of Pump.fun, suggesting an intent to deceive users into believing the site is affiliated with or identical to the legitimate platform. The domain has been flagged by one security vendor on VirusTotal and is blocked by PhishDestroy, a security blocklist. Gridinsoft assigns it a trust score of 0/100, further indicating high-risk classification. The SSL certificate, issued by Google Trust Services, does not mitigate the threat, as fraudulent domains commonly use valid certificates to appear legitimate. Infrastructure analysis reveals no evidence of takedown or mitigation, as the domain remains active with an HTTP 200 status. The use of Cloudflare nameservers (alex.ns.cloudflare.com and roxy.ns.cloudflare.com) is consistent with both legitimate and malicious sites, offering no definitive indication of intent but providing anonymity and DDoS protection. Defenders should treat this domain as a confirmed impersonation threat, particularly for users in the cryptocurrency space. Blocking the domain at the DNS or network level is recommended, alongside monitoring for related infrastructure or similar impersonation attempts targeting Pump.fun or other crypto platforms.