pumppilot[.]fun

Analysis of the domain pumppilot.fun indicates it was actively impersonating the Rainbow platform, targeting users with a wallet or seed-phishing scheme. The domain, registered on November 30, 2025, through NameCheap, Inc., resolved to the IP address 104.21.22.216, hosted on Cloudflare's infrastructure (AS13335) in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (hal.ns.cloudflare.com and margaret.ns.cloudflare.com), a common tactic to obscure hosting details and evade takedowns. The page title, 'Pump Pilot - Boost PumpFun Tokens,' suggests the site was designed to deceive users into interacting with fraudulent token-boosting services, likely harvesting wallet credentials or seed phrases.

At the time of assessment, the domain was offline, though its prior activity was flagged by one security blocklist, and Gridinsoft assigned a trust score of 18 out of 100, indicating elevated risk. VirusTotal data shows two of 95 security vendors marked the domain as malicious, though the absence of an SSL certificate further reduces its legitimacy. The domain was blocked by PhishDestroy, corroborating its classification as a phishing threat. No evidence of a phishing kit or additional payloads was identified in the available data.

Defenders should treat this domain as a confirmed phishing resource targeting cryptocurrency users. Network-level blocks should be implemented for the domain and its resolved IP (104.21.22.216), while endpoint protections should monitor for any residual connections. Given the domain's registration age and Cloudflare hosting, further scrutiny of related infrastructure (e.g., other domains on the same nameservers or IP range) is recommended to identify potential linked threats. The exact content and functionality of the phishing page remain unanalyzed, but the available indicators align with wallet credential theft.