pumpfun[.]rocks

pumpfun.rocks was observed on July 23, 2026 as an offline site that purported to target users of the Pump.fun service. The domain resolves to 188.114.97.3, an address owned by AS13335 Cloudflare, Inc. in the United States. Registration was performed via Cloudflare, Inc., and the authoritative name servers are jay.ns.cloudflare.com and nicole.ns.cloudflare.com, indicating the use of Cloudflare’s DNS hosting. TLS termination is provided by a Google Trust Services certificate issued to the WE1 certificate authority, confirming that the site employed a valid HTTPS certificate despite its malicious intent.

The page title returned by the DNS request is "Pump Game", matching the advertised brand target Pump.fun, and the site is classified as a crypto scam in the intelligence feed. The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy. VirusTotal analysis shows that 14 out of 95 scanned security vendors flagged the domain, reinforcing the suspicion of malicious activity. Detected technologies include Cloudflare’s edge network and HTTP/3 support, consistent with the observed hosting environment.

No additional content or login pages have been captured because the site was taken offline at the time of analysis. Given the observable infrastructure—Cloudflare‑provided DNS and CDN, a public IP address associated with Cloudflare’s network, a valid Google‑issued TLS certificate, and multiple vendor detections—the evidence points to a deliberate impersonation of the Pump.fun brand to lure victims into a cryptocurrency‑related scam. Defenders should add pumpfun.rocks to blocklists, enforce DNS filtering, and monitor the associated IP range for re‑registration attempts. Continuous re‑scanning of the domain is advised in case the operators reactivate the site, and any future HTTP responses should be examined for credential‑collection forms or malicious payloads.