terminalpump[.]com

PhishDestroy identifies terminalpump.com as an active brand impersonation phishing site designed to steal user credentials from Pump.fun users by offering a fake cashback program. The domain masquerades as a legitimate Pump.fun service, leveraging the platform’s reputation to trick victims into entering their login details. The threat actor behind this campaign registered the domain on March 28, 2026, through Metaregistrar BV, and it currently resolves to IP address 188.114.97.3. Notably, the site uses a Let’s Encrypt SSL certificate, which may lend an air of legitimacy to unsuspecting visitors, despite its malicious intent. This domain was flagged with a VirusTotal detection ratio of 0 out of 95 scanners at the time of investigation, indicating it has evaded automated detection systems. The domain’s recent creation date—just days ago—suggests a hastily deployed campaign likely targeting unsuspecting users during a period when vigilance may be lower. The page title, “Pump.fun Cashback - Get % Back on Your Losses,” is crafted to exploit user trust by implying financial benefits, a common tactic in cryptocurrency-related phishing schemes. While the domain itself is not yet widely flagged, its active status and alignment with Pump.fun’s branding make it a significant and evolving threat. If you have visited terminalpump.com, assume your credentials may have been compromised. Immediately change your Pump.fun password and enable two-factor authentication if you haven’t already. Check your account for unauthorized transactions or connections to third-party applications. Do not reuse passwords across platforms, as this could expose other accounts to compromise. Report the domain to Pump.fun’s support team and consider revoking any permissions granted to suspicious applications. Stay vigilant for further phishing attempts and verify any unsolicited offers or links through official channels before interacting.