rugspulls-pump[.]fun

This domain, rugspulls-pump.fun, is actively engaged in brand impersonation targeting Pump.fun, a decentralized platform for token launches. The site presents itself as a legitimate cashback service, falsely promising users 30% compensation for alleged rug pull losses. Current infrastructure analysis confirms the domain remains operational and unmitigated. Infrastructure analysis reveals the domain was registered on May 24, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 188.114.96.3 and employs an SSL certificate issued by Google Trust Services (WE1). Security vendors have flagged the domain, with 2 out of 95 VirusTotal engines detecting malicious activity. The domain appears on three distinct security blocklists, including PhishDestroy, MetaMask, and SEAL. The page title, 'Pump.fun Cashback | Get 30% Back on Rug Pull Losses,' directly mimics Pump.fun’s branding to deceive users into interacting with fraudulent content. As of the latest assessment, rugspulls-pump.fun remains active and poses a high risk to users. Organizations and individuals are advised to block the domain at the network level and update endpoint protection rules to include the associated IP address. Users should be educated on recognizing brand impersonation tactics, particularly those involving fake refund or compensation schemes. Monitoring for additional domains registered through the same registrar or resolving to the same IP may help identify related malicious infrastructure.