pumpfun[.]run

The domain pumpfun.run was registered on 2025-11-26 via PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to 193.24.123.248, an IP owned by AS200593 PROSPERO OOO in Russia. No TLS certificate is present, indicating HTTP‑only service. The authoritative nameservers are jay.ns.cloudflare.com and nicole.ns.cloudflare.com, both Cloudflare‑operated, suggesting the attacker leveraged Cloudflare's DNS for resilience.

The site title returned by HTTP GET is “Pump Game”, which aligns with the brand target Pump.fun. The domain has been flagged by eight of ninety‑five VirusTotal scanners, and it appears on a single external blocklist, where it was subsequently listed by PhishDestroy. The classification in the intelligence set is a “Crypto Scam”, indicating the content likely attempts to solicit cryptocurrency from victims. The domain is currently offline, which may be a temporary takedown or a deliberate cessation of activity.

The evidence base is limited to registration data, IP attribution, DNS configuration, page title, and the VirusTotal detection count; no sample payloads, page screenshots, or traffic logs have been released, leaving the exact luring mechanism uncertain. Defenders should continue to block the IP address 193.24.123.248 and the domain pumpfun.run at DNS and proxy layers, monitor for any re‑registration of the same name or adjacent variations, and add the associated IP range AS200593 to watchlists. Additional telemetry from network sensors that encounter HTTP requests to the domain, as well as any emerging VirusTotal or blocklist entries, should be correlated to detect potential re‑activation. Given the elevated risk rating and the observed brand impersonation of Pump.fun, a proactive containment stance is advised.