feeback-pumps[.]fun

This domain, feeback-pumps.fun, is identified as a high-risk brand impersonation threat targeting Pump.fun, a decentralized platform for token launches. The site masquerades as an official cashback service, offering users 30% reimbursement for rug pull losses—a tactic designed to exploit recent victims of cryptocurrency scams. No direct evidence of a crypto drainer kit was observed, but the domain’s structure and messaging align with phishing campaigns aimed at harvesting credentials or wallet connections under false pretenses. Analysis indicates the domain was registered on June 04, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious registrations. It resolves to the IP address 188.114.97.3, which is part of a network infrastructure commonly leveraged by threat actors to evade detection. VirusTotal reports 13 out of 95 security vendors flagging the domain as malicious, while it appears on four distinct security blocklists. The domain’s SSL certificate is issued by Google Trust Services, a legitimate provider, which may lend an appearance of credibility to unsuspecting users. Additionally, the domain is referenced in two AlienVault OTX threat intelligence pulses, further corroborating its association with malicious activity. As of the latest assessment, feeback-pumps.fun has been taken offline, likely in response to detection by security entities such as MetaMask, PhishDestroy, SEAL, and Maltrail. However, the risk of reemergence remains high, given the domain’s recent creation and the persistent nature of brand impersonation campaigns. Users who interacted with the domain are advised to revoke any connected wallet permissions, monitor for unauthorized transactions, and verify the legitimacy of any communications claiming affiliation with Pump.fun. Organizations should update blocklists to include this domain and its associated IP address to prevent future access attempts.