rugspull-pump[.]fun

This domain, rugspull-pump.fun, is identified as a brand impersonation threat specifically targeting Pump.fun, a cryptocurrency platform. The site falsely advertises a 30% cashback offer on rug pull losses, a common social engineering tactic to lure victims into interacting with malicious infrastructure. No direct evidence of a crypto drainer kit was observed, but the page title and cashback claim strongly suggest intent to harvest credentials or deploy wallet-draining scripts upon user engagement. Analysis indicates the domain was registered on April 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 185.255.122.94 and is flagged by 12 out of 95 security vendors on VirusTotal. The domain appears on four security blocklists and is actively blocked by MetaMask, PhishDestroy, SEAL, and Maltrail. HTTP/3 is the only detected technology, which may be used to evade traditional network monitoring or improve performance for malicious payload delivery. As of the latest assessment, rugspull-pump.fun has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the underlying infrastructure—including the IP and registrar—remains a persistent risk. Users who interacted with the domain should assume credential exposure and monitor associated wallets for unauthorized transactions. Organizations are advised to update blocklists with the domain, IP, and registrar details to prevent future access attempts.