rugsback-pumps[.]fun

This domain is flagged as a high-risk brand impersonation threat targeting users of Pump.fun, a cryptocurrency platform. The site falsely promises a 30% cashback on rug pull losses, a tactic designed to exploit victims of previous crypto scams by offering fraudulent reimbursements. Analysis indicates this is a deliberate attempt to deceive users into engaging with malicious infrastructure under the guise of legitimate compensation. Infrastructure analysis reveals the domain rugsback-pumps.fun was registered on June 07, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to IP address 104.21.57.201, hosted on Cloudflare’s network (AS13335) in the United States. The domain is currently active and appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. VirusTotal reports 8 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy to phishing sites. The page title, "Pump.fun Cashback | Get 30% Back on Rug Pull Losses," directly impersonates Pump.fun’s branding to enhance credibility. Mitigation steps for this brand impersonation threat include immediate blocking of the domain and its associated IP address (104.21.57.201) at the network level. Organizations should update endpoint protection rules to detect and prevent access to rugsback-pumps.fun and similar impersonation domains. Users should be educated to verify the authenticity of any cashback or reimbursement offers through official channels, particularly those involving cryptocurrency transactions. Monitoring for additional domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED or resolving to the same IP may uncover related threats. Incident response teams should treat any interaction with this domain as a potential compromise and investigate for unauthorized transactions or credential exposure.