sale-pump[.]fun

This domain was observed resolving to the IP address 188.114.97.3, which is announced by AS13335 Cloudflare, Inc. and geolocated to the United States. The domain sale-pump.fun was registered on 2025-02-09 through NameCheap, Inc. and is currently hosted behind Cloudflare’s DNS infrastructure, using the authoritative nameservers gwen.ns.cloudflare.com and roman.ns.cloudflare.com. HTTP service fingerprints indicate the presence of Nginx and OpenResty, and the TLS certificate is issued by Let’s Encrypt (R13), confirming a valid HTTPS endpoint at the time of capture. VirusTotal scans show that five of ninety-three security vendors flagged the domain, and AlienVault OTX lists the address in a single threat‑intel pulse.

Independent blocklist providers PhishDestroy and ScamSniffer have added the domain to their blocklists, and the domain appears on two additional security blocklists. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious classification. The page title returned from the web server is “Pump”, and the intelligence tags the activity as a crypto‑scam that impersonates the Telegram brand. The domain is presently offline, which may indicate takedown or temporary suspension, but the infrastructure artifacts remain observable.

Defenders should continue to block traffic to 188.114.97.3 and to the fully qualified domain name sale-pump.fun at the DNS layer, update intrusion‑prevention signatures to include the observed Nginx/OpenResty fingerprint, and monitor for any re‑registration attempts using the same registrar or similar naming patterns. Correlation of outbound connections from internal hosts to the Cloudflare IP range should be investigated, especially if TLS handshakes present the Let’s Encrypt R13 certificate. Because the domain has already been listed on multiple blocklists, integrating those feeds into web‑gateway and email filtering solutions will reduce exposure.