payback-pump[.]fun

This domain, payback-pump.fun, poses as the legitimate cryptocurrency platform Pump.fun to deceive users into entering sensitive account credentials. The site presents a counterfeit login interface designed to harvest usernames, passwords, and potentially two-factor authentication codes. Visitors attempting to access their crypto assets through this domain risk immediate account compromise and unauthorized fund transfers to attacker-controlled wallets. The threat primarily targets users who may be searching for alternative access points or responding to fake promotional offers. Analysis indicates this is not a legitimate service. The domain was registered on April 8, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. Security vendors have flagged the domain in 15 out of 95 detection engines, with two major blocklists already listing it as malicious. The site previously resolved to IP address 145.79.20.156, which has been linked to other brand impersonation campaigns in recent months. The combination of recent registration, offshore registrar, and security detections establishes clear indicators of malicious intent. If you visited payback-pump.fun or entered any login credentials, immediate action is required. First, change your Pump.fun password using a different device and enable multi-factor authentication if not already active. Next, review your account for any unauthorized transactions or connected devices, revoking access to any unfamiliar sessions. Monitor your linked wallets for unusual activity and consider transferring assets to a new wallet if suspicious transactions appear. Report the incident to Pump.fun's official security team and consider filing a report with relevant cybercrime authorities. Always verify domain names carefully before entering credentials, particularly for financial services.