pump[.]fan-eye[.]live

This domain, pump.fan-eye.live, is identified as a brand_impersonation phishing infrastructure currently offline. It specifically targets users of Pump.fun, a cryptocurrency token launch platform, by replicating its interface and displaying fraudulent token pages with dynamic placeholders for token names and symbols. Analysis indicates the domain was flagged by 4 of 95 security vendors on VirusTotal, appearing on two independent security blocklists. It was registered on March 05, 2026, through Global Domain Group LLC and resolves to the IP address 151.101.2.15. The SSL certificate is issued by Let's Encrypt, a common tactic to lend superficial legitimacy to phishing sites. Additional technical assessments assign a trust score of 0 out of 100, reinforcing its malicious classification. The page title observed, {{TOKEN_NAME}} ({{TOKEN_SYMBOL}}) - pump.fun, mimics legitimate Pump.fun token pages, suggesting an intent to deceive users into interacting with counterfeit smart contracts or disclosing wallet credentials. As of the latest verification, pump.fan-eye.live has been taken offline. However, threat actors frequently redeploy similar infrastructure under new domains. Users and security teams are advised to monitor for domains containing 'pump' and 'fan' or 'eye' in proximity, particularly those with recent creation dates or unusual top-level domains. Network-level blocking of the resolved IP, 151.101.2.15, may mitigate residual risk. Cryptocurrency platforms should proactively alert users to verify domain authenticity before connecting wallets or approving transactions. Security teams are encouraged to integrate the observed indicators—domain, IP, registrar, and SSL issuer—into threat intelligence feeds for cross-sector detection.