losesbacks-pump[.]fun

This domain, losesbacks-pump.fun, is flagged as a high-risk brand impersonation threat specifically targeting Pump.fun, a decentralized platform for token launches. The site masquerades as an official cashback service, falsely promising users 30% reimbursement for losses incurred from rug pulls. Such schemes are commonly associated with crypto drainers or fraudulent recovery services designed to exploit victims of previous scams by soliciting sensitive wallet information or direct payments under false pretenses.

Infrastructure analysis reveals multiple technical indicators supporting its malicious classification. The domain was registered on June 05, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently observed in abuse reports. It resolves to the IP address 104.21.8.94, which is proxied through Cloudflare, a service often leveraged to obscure hosting origins. Security vendors on VirusTotal flagged the domain at a ratio of 15/95, while it appears on four distinct security blocklists, including MetaMask, PhishDestroy, SEAL, and Maltrail. The SSL certificate is issued by Google Trust Services, which, while legitimate, does not mitigate the domain's fraudulent intent. Additional detections include two threat intelligence pulses on AlienVault OTX and a Gridinsoft trust score of 0/100, further corroborating its malicious nature. The domain is currently offline, likely due to takedown actions or voluntary suspension by the threat actor.

Mitigation steps for users and organizations include immediate blocking of the domain and its associated IP address (104.21.8.94) at the network perimeter. Users who interacted with the site should assume their wallet credentials or recovery phrases may be compromised and take steps to revoke any connected dApp permissions, transfer assets to a new wallet, and monitor for unauthorized transactions. Organizations operating in the cryptocurrency space should proactively monitor for similar impersonation domains, particularly those using variations of their brand name combined with terms like 'cashback,' 'recovery,' or 'refund.' Security teams are advised to enrich threat intelligence feeds with the domain's indicators of compromise (IoCs) and conduct retrospective analysis to identify any prior exposure within their environments. Additionally, user education campaigns should emphasize the risks of engaging with unsolicited recovery or reimbursement offers, as these are recurring tactics in post-exploitation fraud.