newyear-pump[.]fun

Analysis of newyear-pump.fun, created on 19 December 2025 and currently taken offline, indicates an elevated‑risk crypto‑scam infrastructure that impersonates the brand Pump.fun. The domain resolves to 188.114.97.3, an address owned by AS13335 Cloudflare, Inc., located in the United States. No TLS certificate was presented during the brief observation period, suggesting the site was served over plain HTTP. The registrar listed is PDR Ltd. d/b/a PublicDomainRegistry.com and the authoritative name servers are annalise.ns.cloudflare.com and chris.ns.cloudflare.com, both Cloudflare‑operated, which aligns with the observed IP host.

VirusTotal scans show that four of ninety‑five AV engines flagged the domain, providing independent corroboration of malicious intent. The domain appears on at least one public blocklist and has been recorded in three AlienVault OTX pulses, reinforcing its presence in threat‑intel feeds. Gridinsoft assigns a trust score of zero out of one hundred, and PhishDestroy has already blocked the host. The only visible page title retrieved before takedown was "Nur einen Moment…," offering no further insight into the landing content.

The evidence points to a deliberate brand‑impersonation campaign targeting users of Pump.fun, likely leveraging crypto‑related lures to harvest credentials or funds. However, the exact payload, phishing kit, or redirection chain remains unknown because the site was taken offline before a full content capture could be performed. Defenders should continue to monitor the IP address for any re‑hosting activity, enforce strict domain‑level filtering for newyear-pump.fun and its associated Cloudflare name servers, and update endpoint and web‑gateway blocklists accordingly. Organizations that permit outbound connections to Cloudflare‑hosted domains should consider applying additional heuristics to detect anomalous traffic patterns originating from this IP range.