pumpfun-site-2-sol-zr41n3r[.]pages[.]dev

The domain pumpfun-site-2-sol-zr41n3r.pages.dev was identified as a brand impersonation threat specifically targeting Pump.fun, a decentralized token launch platform. Analysis confirms the domain was designed to mimic the legitimate Pump.fun interface, likely to deceive users into disclosing credentials or interacting with malicious smart contracts. The page title, Verification, suggests an attempt to simulate an authentication process, a common tactic in credential harvesting schemes. As of the latest assessment, the domain has been taken offline, though prior activity indicates an elevated risk profile. Infrastructure analysis reveals the domain was registered on May 20, 2026, through Cloudflare, Inc., and resolved to the IP address 188.114.97.3. The SSL certificate was issued by Google Trust Services, a legitimate provider, which does not mitigate the domain's malicious intent. Security vendors flagged the domain in 1 of 95 VirusTotal scans, while Gridinsoft assigned a trust score of 0 out of 100. The domain appeared on one security blocklist, specifically PhishDestroy, further corroborating its fraudulent nature. Technologies detected include HSTS, Cloudflare hosting, and HTTP/3, which are commonly used by both legitimate and malicious sites to enhance performance and security, though in this case, they were leveraged to lend an air of legitimacy to the fraudulent operation. The domain is currently offline, reducing immediate exposure risk. However, users who may have interacted with the site should assume potential compromise of sensitive data, including wallet credentials or private keys. It is recommended to revoke any connected smart contract approvals, monitor accounts for unauthorized transactions, and verify the authenticity of any communications or websites claiming affiliation with Pump.fun. Organizations should update blocklists to include this domain and its associated indicators, such as the IP address and SSL certificate details, to prevent future access attempts. Continuous monitoring of newly registered domains with similar naming patterns is advised to detect and mitigate emerging threats.