pumpfun-bonus[.]info

This domain, pumpfun-bonus.info, is identified as a brand_impersonation phishing campaign targeting the Jupiter cryptocurrency platform. The site employs an Airdrop Scam phishing kit, designed to deceive users into interacting with fraudulent airdrop claims under the guise of the legitimate Pump.fun brand. Analysis confirms the domain is explicitly engineered to exploit trust in Jupiter’s ecosystem, likely aiming to harvest credentials or deploy malicious smart contracts. Infrastructure analysis reveals the following technical indicators: the domain was registered on January 01, 2026, through NiceNIC International Group Co., Limited. It resolves to the IP address 172.67.189.213, a hosting node frequently associated with low-reputation traffic. VirusTotal detection metrics report 5 out of 95 security vendors flagging the domain as malicious. The domain appears on four distinct security blocklists, including integration with widely adopted threat intelligence feeds. At the time of assessment, Google Safe Browsing (GSB) had not yet incorporated the domain into its active blocklist, though this may reflect a lag in propagation rather than benign status. As of the latest verification, pumpfun-bonus.info has been taken offline, likely in response to automated takedown requests or registrar enforcement. However, the domain’s infrastructure remains registered, and the underlying threat actor retains control over DNS records. The risk level is classified as elevated due to the domain’s prior operational status, its use of a known phishing kit, and its presence on multiple blocklists. Users are advised to treat any prior interaction with the domain as compromised and to monitor for secondary attack vectors, including wallet drainers or credential reuse attempts.