pump-gui[.]fun

The domain pump-gui.fun has been assessed as a high-risk site with a specific threat type of crypto drainer. This type of threat typically aims to deceive users into providing their cryptocurrency wallet information, leading to unauthorized access and potential loss of funds.

Analysis indicates that pump-gui.fun is flagged by 11 out of 95 security vendors on VirusTotal, suggesting a moderate level of consensus among security professionals regarding its malicious nature. The domain is registered through PDR Ltd. d/b/a PublicDomainRegistry.com, a common registrar for suspicious and malicious domains. The IP address to which the domain resolves, 172.67.181.113, is known to be associated with Cloudflare services, which can be used to obfuscate the true origin of the traffic. The domain was created on April 20, 2026, and has already appeared on three security blocklists, further corroborating its involvement in malicious activities. Additionally, the site is blocked by MetaMask, PhishDestroy, and SEAL, indicating that it poses significant risks to users of these security tools.

To mitigate the risks associated with this crypto drainer, users are advised to exercise extreme caution when visiting or interacting with pump-gui.fun. It is recommended to avoid clicking on any links or entering sensitive information on the site. Users should also ensure that their cryptocurrency wallets and other financial accounts are secured with strong, unique passwords and two-factor authentication. Security tools such as MetaMask and PhishDestroy should be updated to the latest versions to benefit from the latest threat detection capabilities. Organizations may consider adding this domain to their firewall and DNS blocklists to prevent access from within their networks.