rug-cashback[.]live

This domain, rug-cashback.live, was identified as a brand_impersonation threat targeting users of the Pump.fun platform. The site falsely advertised a '30% cashback on losses' program, a common tactic to deceive victims into disclosing credentials, wallet keys, or transferring funds under the guise of a legitimate refund or reward. Such schemes often exploit trust in well-known brands to bypass user skepticism, particularly in cryptocurrency-related contexts where irreversible transactions are a critical risk factor.

Analysis indicates the domain was registered on March 24, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolved to the IP address 172.67.174.48 and employed Cloudflare services, including Cloudflare Browser Insights and HTTP/3, likely to obfuscate its infrastructure and evade detection. At the time of assessment, 13 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appeared on one security blocklist. The Gridinsoft trust score of 0/100 further corroborates its high-risk classification. The domain has since been taken offline, but its prior activity and technical indicators remain relevant for retrospective threat hunting.

Users who visited rug-cashback.live or interacted with its content should assume potential exposure. Immediate actions include revoking access to any linked cryptocurrency wallets, rotating credentials for associated accounts (particularly those tied to Pump.fun or other financial platforms), and monitoring for unauthorized transactions. If funds were transferred, report the incident to relevant blockchain analysis services and local cybercrime authorities. Additionally, review browser extensions, installed applications, and device logs for signs of compromise, as brand_impersonation sites may deploy malware or harvest session tokens.