cashback-padre[.]gg

cashback-padre.gg is an active domain created on 28 February 2026 and resolves to the IPv4 address 162.213.255.43, which is allocated to AS22612 (Namecheap, Inc.) in the United States. The domain is registered through NameCheap, Inc. and uses the authoritative name servers dns1.namecheaphosting.com and dns2.namecheaphosting.com. TLS is provided by a Sectigo Limited DV certificate issued by Sectigo Public Server Authentication CA R36, indicating a valid HTTPS endpoint that returns HTTP 200. MX records are configured with priority 5 pointing to mx1-hosting.jellyfish.systems and a priority 10 entry to a second jellyfish.systems host. The web server identifies itself as LiteSpeed, and the Gridinsoft trust score is 0 / 100, reflecting a malicious rating. The site’s page title, “Pump.fun Cashback – Get % Back on Your Losses,” and the explicit brand target of Pump.fun demonstrate a brand‑impersonation campaign aimed at crypto‑related users. The content is classified as a crypto scam. Independent analysis shows the domain appears on three security blocklists and is flagged by four of ninety‑three VirusTotal scanners. It is currently blocked by PhishDestroy, MetaMask, and SEAL. While the observed infrastructure confirms the malicious intent, the exact phishing payload, credential‑capture mechanisms, and any post‑compromise activity have not been publicly disclosed. Defenders should block connections to 162.213.255.43, add cashback‑padre.gg to URL filtering and email security policies, and monitor for related indicators of compromise that reference the Pump.fun brand. Continuous surveillance of the domain’s DNS and SSL characteristics is recommended, as the infrastructure may be reused in future campaigns.