scan-pump[.]fun

PhishDestroy identifies scan-pump.fun as an active brand impersonation domain masquerading as Pump.fun, with strong indicators of a crypto drainer campaign. The domain leverages visual and textual mimicry to deceive users into connecting crypto wallets or entering credentials, a tactic commonly associated with fund theft. Given its recent creation and low detection rates, this threat poses a significant risk to cryptocurrency users seeking to interact with legitimate platforms like Pump.fun. This domain was flagged by ScamSniffer and appears on one security blocklist, while VirusTotal currently shows 4 out of 95 detections—suggesting it has evaded widespread recognition. Registered on April 22, 2026, via REG.RU LLC, it resolves to IP 104.21.66.113 and uses a Let's Encrypt SSL certificate, which may enhance its credibility. Despite its low detection score, the presence of a single blocklist entry and prior blocking by ScamSniffer indicate early-stage malicious activity that warrants immediate attention. To mitigate exposure, users should avoid interacting with scan-pump.fun entirely. Always verify URLs through trusted sources such as PhishDestroy and confirm official domains via Pump.fun’s legitimate channels. If you’ve already engaged with this domain, disconnect any connected wallets immediately and revoke any unwarranted permissions through your wallet’s security settings. Enable transaction alerts and use hardware wallets where possible to minimize exposure to crypto drainers. Report any suspicious activity to PhishDestroy to help strengthen collective defense against emerging threats.