lunarpump[.]fun

Analysis on lunarpump.fun indicates an active brand‑impersonation campaign targeting users of Pump.fun. The site returns HTTP 200 and presents the page title “LunarPumpFun”. Registration details show the domain is hosted behind Cloudflare, Inc., using the nameservers bradley.ns.cloudflare.com and luciana.ns.cloudflare.com, and the TLS certificate is issued by Let’s Encrypt (E8). The server resolves to 185.229.32.227, an address located in the Netherlands and associated with Etheron Hosting. The domain has been flagged by PhishDestroy and appears on one public blocklist. VirusTotal scans show a single detection out of 91 security vendors, confirming at least one vendor identified malicious behavior. The infrastructure suggests a low‑cost, fast‑deployment approach typical of brand‑impersonation kits, but no additional payload or page content has been publicly disclosed. Defenders should add lunarpump.fun to URL filtering and DNS block lists, monitor outbound connections to the associated IP, and consider tightening email filters for messages referencing Pump.fun. Ongoing observation is advised to detect any evolution of the site’s content or additional malicious activity.