cashbackpump[.]app

This domain, cashbackpump.app, is assessed as a high-risk brand impersonation scam specifically targeting users of the Pump.fun platform. The site falsely promises cashback on losses, a common tactic to lure victims into interacting with malicious smart contracts or disclosing sensitive credentials. Analysis indicates this is not a generic phishing attempt but a targeted impersonation scheme designed to exploit trust in the Pump.fun brand, likely deploying crypto drainer functionality or fake login portals to siphon assets. Infrastructure analysis reveals multiple high-confidence threat indicators. The domain was registered on March 27, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with fraudulent domains. It resolves to the IP address 104.21.15.229, which is proxied through Cloudflare, a common obfuscation technique used to conceal hosting origins. The domain appears on four security blocklists and is actively blocked by MetaMask, PhishDestroy, SEAL, and Maltrail. Gridinsoft assigns a trust score of 0/100, and VirusTotal reports 15 out of 95 security vendors flagging the domain as malicious. Detected technologies include Cloudflare Browser Insights and HTTP/3, further suggesting an attempt to mimic legitimate web infrastructure while evading detection. Mitigation requires immediate action from both users and platform operators. Users who interacted with this domain should revoke all connected wallet permissions, transfer remaining assets to a new secure wallet, and scan devices for malware. Platform administrators should issue public warnings, blacklist the domain across all security layers, and monitor for similar impersonation patterns using the detected indicators: the registrar PDR Ltd., the Cloudflare-proxied IP 104.21.15.229, and the distinctive page title 'Pump.fun Cashback - Get % Back on Your Losses.' Proactive measures include implementing domain monitoring for newly registered lookalike domains and educating users on verifying official communication channels to prevent engagement with fraudulent schemes.