pump-online[.]top

The domain pump-online.top was registered on 27 February 2026 through PublicDomainRegistry.com (operated by PDR Ltd.). It resolves to the Cloudflare edge address 188.114.97.3, which belongs to AS13335 in the United States. The domain is currently listed as offline, and no TLS certificate is presented, meaning any HTTP request would be unencrypted. The authoritative nameservers are rohin.ns.cloudflare.com and ximena.ns.cloudflare.com, both belonging to Cloudflare’s DNS infrastructure. The site’s sole observed page title is “GYMSKIN CLIPS ($GYMSKIN) — pump.fun”, directly referencing the legitimate brand Pump.fun and indicating a brand‑impersonation attempt.

Security‑vendor scans on VirusTotal show that 2 of 93 engines flagged the domain, and the domain appears on three reputable blocklists: PhishDestroy, MetaMask, and SEAL, confirming its classification as a crypto‑related scam. The intelligence tags the activity as a “Crypto Scam”, consistent with the use of a token‑style name in the page title. Defenders should treat any traffic to pump‑online.top as malicious. Immediate actions include adding the domain to network‑level deny lists, enforcing DNS‑based blocking, and ensuring that endpoint protection solutions that reference the three blocklists are updated.

Because the domain uses Cloudflare’s shared IP space, consider monitoring for other sub‑domains that resolve to the same IP or that share the same nameserver pair, as threat actors often recycle the same hosting. Continuous observation of the registrar’s new registrations for similarly patterned names (e.g., “pump‑online”) is advisable. Since the site currently returns no SSL certificate, any attempt to establish a TLS connection will fail, providing an additional indicator for detection rules. Organizations should also educate users about the risk of unsolicited links that claim to be from Pump.fun, especially those mentioning token symbols such as $GYMSKIN, and advise verification through official channels.