presales-pump[.]fun

Analysis of the domain presales-pump.fun indicates it was a crypto scam impersonating Pump.fun, active for approximately two weeks before being taken offline. Registered on July 11, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolved to Cloudflare infrastructure (AS13335) via IPv6 address 2606:4700:3030::6815:2418. The SSL certificate was issued by WE1, a low-assurance provider commonly used in malicious campaigns. At the time of assessment, only one of 93 security vendors on VirusTotal flagged the domain, and it appeared on a single blocklist maintained by PhishDestroy.

Gridinsoft assigned a trust score of 0/100, reinforcing its suspicious classification. The page title 'Et øjeblik ...' suggests a placeholder or transitional state, though the exact content remains unanalyzed. The domain was explicitly categorized as a crypto scam, aligning with its naming convention and the targeted brand, Pump.fun. Infrastructure analysis reveals no additional hosting anomalies beyond its Cloudflare association, which is frequently leveraged by threat actors to obscure origin servers.

Defenders should treat this domain as malicious, particularly in environments where Pump.fun or similar crypto platforms are accessed. Blocking the domain and its resolving IP at perimeter controls is recommended. Further investigation into related domains registered through the same registrar or resolving to identical Cloudflare IPs may uncover additional threats.