padre-cashback[.]fun

This domain operates as a fraudulent cashback portal targeting users of the Pump.fun platform. The site displays a fabricated offer promising refunds on trading losses, a common tactic to harvest credentials and wallet recovery phrases from unsuspecting cryptocurrency users. Analysis indicates this is a classic brand impersonation scheme designed to exploit trust in legitimate services. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain padre-cashback.fun was registered on March 04, 2026 through NiceNIC International Group Co., Limited. Security vendors have flagged the domain, with VirusTotal showing 2 out of 95 engines detecting malicious activity. The site appears on five security blocklists including MetaMask and ScamSniffer, and resolves to IP address 188.114.97.3. Additional technical observations include Cloudflare protection and HSTS implementation, which are often used to lend false legitimacy to phishing infrastructure. Users who visited this domain should take immediate action to secure their accounts. First, disconnect any wallet connections made through the site and revoke permissions via the legitimate platform's interface. Change passwords for any accounts where credentials may have been entered, using strong unique passwords. Monitor connected wallet addresses for unauthorized transactions and consider moving funds to a new wallet if any suspicious activity is detected. Report the incident to the legitimate service provider and relevant security teams to help prevent further victimization.