cashback-pumps[.]fun

This domain, cashback-pumps.fun, is identified as a brand impersonation threat targeting Pump.fun, a decentralized platform for token launches. Analysis of the page title, 'Pump.fun Cashback | Get 30% Back on Rug Pull Losses,' indicates an attempt to deceive users by offering fraudulent financial incentives, likely to harvest credentials or distribute malicious payloads. No evidence of a crypto drainer kit was observed, but the social engineering tactics align with common phishing campaigns exploiting recent rug pull incidents in the crypto space.

Technical indicators confirm elevated risk: the domain was created on March 04, 2026, and resolves to the IP address 82.29.199.184. It is registered through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. VirusTotal detections stand at 6/95 security vendors, and the domain appears on one security blocklist. No SSL certificate is present, and Google Safe Browsing (GSB) does not currently list the domain, though this may reflect its recent takedown rather than a clean status. Infrastructure analysis reveals no apparent bulletproof hosting, but the lack of encryption and minimal blocklist presence suggest either a low-sophistication operation or a deliberate attempt to evade detection.

As of the latest assessment, cashback-pumps.fun has been taken offline, likely due to enforcement action or abandonment by the threat actor. However, residual risk remains for users who may have interacted with the domain prior to its removal. Organizations and individuals are advised to monitor for unauthorized access attempts linked to this domain, particularly in environments where Pump.fun credentials may have been reused. Network-level blocking of the IP 82.29.199.184 and the domain itself is recommended as a precautionary measure. Users should verify all communications claiming to originate from Pump.fun through official channels and report any suspicious activity to relevant security teams.