pumpfun[.]nikiw[.]org

The domain pumpfun.nikiw.org is a confirmed phishing site engaged in brand impersonation targeting Pump.fun, a cryptocurrency platform. This scam site was designed to deceive users into believing they were interacting with the legitimate Pump.fun service, potentially leading to financial loss through cryptocurrency fraud. As of the latest verification, pumpfun.nikiw.org has been taken offline, though users who previously visited the site may still be at risk.

Technical analysis reveals that pumpfun.nikiw.org was flagged by 2 of 95 security vendors on VirusTotal, including Gridinsoft and SOCRadar. The domain was registered through Spaceship, Inc. on February 21, 2026, and resolved to the IP address 104.21.78.215, hosted by Cloudflare in the United States. It appeared on one security blocklist, PhishDestroy, and used an SSL certificate issued by Google Trust Services / WE1. The observed page title was 'Just a moment...', and the site employed technologies such as Cloudflare Browser Insights and HTTP/3. No drainer kit was detected, but the scam type was identified as cryptocurrency-related.

Users who may have interacted with pumpfun.nikiw.org should immediately revoke any token approvals granted to unknown or suspicious contracts and transfer their funds to a new, secure wallet. Additionally, monitor accounts for unauthorized transactions and enable two-factor authentication (2FA) on all cryptocurrency-related services. Victims are advised to report the phishing domain to their wallet provider, the impersonated brand (Pump.fun), and relevant authorities such as the Anti-Phishing Working Group (APWG) or local cybercrime units.