go-pumptololf[.]xyz

This domain, go-pumptololf.xyz, is actively engaged in brand impersonation targeting Pump.fun, a decentralized platform for token launches. The threat type is classified as high-risk due to its deceptive mimicry of legitimate bounty programs, as indicated by the page title 'Bounties | Pump.fun.' The domain remains operational and unresolved as of the latest verification, posing an ongoing risk to users who may inadvertently disclose sensitive information or credentials. Analysis indicates that go-pumptololf.xyz was registered through NameCheap, Inc. on June 12, 2026, and currently resolves to the IP address 104.21.54.199. Security vendors on VirusTotal have flagged this domain, with 1 out of 95 vendors identifying it as malicious. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend an appearance of legitimacy. Infrastructure analysis reveals that the domain appears on three security blocklists and is actively blocked by multiple threat intelligence platforms, including PhishDestroy and MetaMask. The current status of go-pumptololf.xyz is active, and users are advised to exercise extreme caution. Organizations should immediately update their security blocklists to include this domain and its associated IP address. End-users are urged to verify the authenticity of any communications or websites claiming affiliation with Pump.fun by cross-referencing official channels. Network administrators should monitor for connections to 104.21.54.199 and investigate any anomalous traffic originating from internal systems. Proactive measures, such as implementing DNS filtering and educating users on identifying brand impersonation tactics, are recommended to mitigate the risk posed by this domain.