prompump[.]fun

Analysis of the domain prompump.fun, observed on July 25, 2026, indicates it was created on February 27, 2026 and is currently offline. The site was designed to impersonate the legitimate brand Pump.fun, as reflected in the known impersonation tag and the brand target field. The page title retrieved from the site was "Just a moment...", and no SSL certificate was presented, suggesting the site operated without HTTPS protection. Network resolution shows the domain points to IP address 188.114.97.3, which is hosted in the United States under Autonomous System AS13335 belonging to Cloudflare, Inc. Nameserver records list everton.ns.cloudflare.com and jo.ns.cloudflare.com, confirming Cloudflare’s DNS service usage.

Registration was performed through NiceNIC International Group Co., Limited. Reputation checks reveal a Gridinsoft trust score of 0 out of 100, indicating a highly untrusted rating. VirusTotal analysis recorded 2 detections out of 93 security vendors, confirming that at least two independent scanners flagged the domain as malicious. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service.

The identified scam type is a crypto scam, aligning with the brand‑impersonation motive. Given the offline status, immediate traffic to the domain is halted, yet the underlying infrastructure—particularly the Cloudflare IP and DNS configuration—could be repurposed for future malicious campaigns. Defenders should continue to block the domain at perimeter defenses, monitor for re‑registration or similar domains using the same IP range, and incorporate the domain’s indicators (IP address, nameservers, registration details) into threat‑intel feeds. Ongoing vigilance is advised to detect any resurgence of the impersonation activity or the emergence of related crypto‑focused phishing attempts.