x[.]com-pump[.]fun

This domain x.com-pump.fun is currently flagged as a brand‑impersonation site targeting Pump.fun. The domain was registered on December 06, 2025 through NiceNIC International Group Co., Limited and resolves to the Cloudflare edge address 172.67.185.55, which is associated with AS13335 Cloudflare, Inc. in the United States. The site presents no SSL certificate, and the Gridinsoft trust score is 0 out of 100, indicating a lack of reputation. HTTP requests return a generic page titled “Just a moment…”, and the site has been taken offline at the time of this analysis.

Threat intelligence identifies the campaign as a crypto‑scam that masquerades as Pump.fun. The domain appears on two independent blocklists, PhishDestroy and ScamSniffer, and five of ninety‑three VirusTotal scanners have raised detections. No other public Safe Browsing or OTX entries are recorded. While the hosting infrastructure is shared with legitimate Cloudflare customers, the absence of a valid TLS certificate and the low trust score suggest deliberate abuse of the provider’s CDN to hide malicious activity.

Defenders should block any outbound connections to 172.67.185.55 and add x.com-pump.fun to domain‑allowance deny lists. Email gateways should flag messages containing URLs that resolve to this domain, and SOC analysts should monitor for any attempts to reference Pump.fun credentials or crypto wallet addresses. Because the site is currently offline, historical traffic logs should be reviewed to identify any prior engagements. Continuous monitoring of the registrar NiceNIC and the Cloudflare ASN for new domains that mimic Pump.fun is recommended to catch future iterations of this campaign.