fun-cashback[.]info

The domain fun-cashback.info was registered on March 7, 2026 through Global Domain Group LLC and is currently flagged as a high‑risk brand‑impersonation site targeting the Ankr brand. VirusTotal records show that 3 out of 95 security vendors have flagged the domain, indicating partial detection. The site returns an HTTP 301 redirect and presents a TLS certificate issued by Let’s Encrypt (certificate identifier E8). Infrastructure analysis reveals the domain resolves to the IP address 172.67.168.254, which belongs to the Cloudflare network (AS13335, United States). The authoritative name servers are evan.ns.cloudflare.com and aliza.ns.cloudflare.com. Detected third‑party technologies include Apple iCloud Mail, Amazon Web Services, Vercel, web‑vitals, Unpkg, LaunchDarkly, HTTP Strict Transport Security (HSTS), and Google Tag Manager. These components suggest the site is hosted on a cloud platform and leverages a modern web stack. The page title observed for the site is “Pump”, and the domain appears on three security blocklists. It has been explicitly blocked by PhishDestroy, MetaMask, and SEAL, confirming that multiple threat‑intel feeds have identified it as malicious. The Gridinsoft trust score is 0 out of 100, reinforcing the low credibility of the site. No additional content analysis is available, so the exact phishing page layout or credential‑collection mechanisms remain unverified. Defenders should add fun-cashback.info to network‑level deny lists and ensure that email gateways block any messages containing this domain. Monitoring of DNS queries for the associated Cloudflare name servers can help detect internal attempts to resolve the domain. Given the active status and high risk rating, security teams should also alert end‑users, particularly those familiar with Ankr services, to disregard any unsolicited communications referencing this domain. Continuous re‑evaluation is advised as further intelligence becomes available.