backcash-pumpfun[.]solvoid[.]cc

PhishDestroy identifies backcash-pumpfun.solvoid.cc as an active brand impersonation site targeting Pump.fun. The domain uses a visually deceptive name—backcash-pumpfun.solvoid.cc—to masquerade as the legitimate Pump.fun platform, aiming to harvest user credentials or cryptocurrency wallet access through fake login pages or drainer kits embedded within the site. The campaign is likely intended to trick users into connecting their wallets or entering login credentials, leveraging the trusted reputation of the Pump.fun brand to lower suspicion.

This domain was flagged with the following technical indicators: it resolves to IP 188.114.97.3, uses a Let’s Encrypt SSL certificate, and was registered on May 02, 2026 via NICENIC INTERNATIONAL GROUP CO., LIMITED. As of the latest scan, VirusTotal reports 7 out of 95 detection engines flagging the domain, indicating a low current detection rate. The domain remains unblocked by Google Safe Browsing (GSB) and has not yet been listed on major threat intelligence blocklists.

The campaign is currently active with low AV coverage, posing a credible risk to unsuspecting users interacting with Pump.fun-related content. Immediate action is required: domain blocking at the network level, takedown requests to hosting providers (Cloudflare via IP 188.114.97.3), and user advisories to avoid interacting with this domain. While the exact drainer kit has not been fully extracted, the impersonation strategy strongly suggests credential theft or crypto-draining functionality. Remaining risk is assessed as high due to active status, zero detections, and targeted branding deception.