pumpkingbundler[.]com

Analysis of pumpkingbundler.com indicates a high‑confidence brand‑impersonation operation targeting the Across brand. The domain was registered on 11 June 2025 through Name.com, Inc. and resolves to the IP address 63.176.8.218, which resides in Germany and is advertised as part of Amazon.com, Inc. (AS16509). The hosting environment is identified as Netlify and the site enforces HTTP Strict Transport Security (HSTS). The TLS certificate is issued by Let’s Encrypt (E7) and appears valid for the domain. Infrastructure signals include four nsone.net name servers (dns1.p02.nsone.net through dns4.p02.nsone.net), a common configuration for fast‑deployment services.

The page title observed before takedown reads “PumpKing Bot 🎃👑 - Automated Token Launch & Trading Bot for Pump.fun | Solana DeFi”, which aligns with the classified scam type of a crypto scam. The domain is listed on a single security blocklist and has been explicitly blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, indicating a lack of benign reputation. VirusTotal scanning reports a single positive detection out of 95 scanners, reinforcing the malicious assessment. Current status is offline, suggesting that the content has been removed or the hosting provider has taken action.

Nevertheless, the combination of a recent registration date, low trust score, association with a known blocklist, and the presence of a crypto‑related page title strongly supports the conclusion that the domain was used for brand impersonation and likely for fraudulent token promotion. Uncertainty remains regarding the exact victims or financial loss, as no victim reports are available in the supplied data. Defenders should continue to block the domain at network perimeter and email gateways, monitor DNS queries for the associated IP and name‑server set, and add the domain to internal blocklists.