legopumpfun[.]com

Analysis indicates that the domain legopumpfun.com is actively being used to impersonate the Pump.fun brand. The site presents a page titled “$LEGO - Build Your Future,” which mimics legitimate branding and aims to mislead users seeking Pump.fun services. The domain was registered on December 21 2025 through GoDaddy.com, LLC, and is presently resolved to the IP address 216.150.1.1, hosted by Vercel, Inc. The server presents a Let’s Encrypt R12 certificate, and HTTP requests receive a 307 redirect response. Network analysis shows the endpoint resides in the United States and is associated with Vercel’s hosting infrastructure. The domain’s trust score of 44 / 100 from Gridinsoft places it in a low‑reputation range, and it appears on a single security blocklist. AlienVault OTX has referenced the domain in one threat‑intelligence pulse, while PhishDestroy already blocks it. The lack of detections on VirusTotal (0 / 95) does not imply safety, as the site has not yet been scanned by many engines. The observed 307 redirect suggests the site may forward victims to a secondary landing page designed to harvest credentials or install malicious payloads. The use of a brand‑related page title combined with a seemingly innocuous LEGO motif is a classic impersonation technique intended to increase click‑through rates. No additional malware indicators have been identified, and the short operational lifespan (registered less than a year) limits historical telemetry. Defenders should add legopumpfun.com to blocklists and monitor DNS queries for the 216.150.1.1 address. Email filtering rules should be updated to flag messages referencing Pump.fun that contain links to this domain. Continuous scanning of the domain on multi‑engine platforms is advised to capture any emerging detections. Organizations using the Pump.fun brand should educate users about the illegitimate $LEGO page and encourage verification of TLS certificates and URLs before credential entry.