punpfun[.]cfd

The domain punpfun.cfd was registered on May 25, 2025 through Web Commerce Communications Limited and resolves to the IP address 188.114.96.3, which is owned by Cloudflare, Inc. (AS13335) and geolocated in the United States. DNS resolution is handled by the Cloudflare nameservers johnny.ns.cloudflare.com and sharon.ns.cloudflare.com, and the site was served over HTTP/3 using Cloudflare’s infrastructure. The TLS certificate presented by the host is issued by Google Trust Services under the WE1 label, indicating a valid, publicly trusted certificate chain. The page title returned by the server is "Pump", and the domain is explicitly reported to impersonate the legitimate brand Pump.fun.

Classification from the supplied intelligence identifies the activity as a crypto scam. VirusTotal analysis shows that 15 of 93 scanning engines flagged the domain, suggesting malicious characteristics. AlienVault OTX references the domain in a single threat‑intel pulse, and the site is listed on one security blocklist. PhishDestroy has taken the domain offline, and its current status is reported as taken offline.

While the offline status limits immediate threat exposure, the combination of a trusted SSL certificate, Cloudflare front‑end, and brand impersonation indicates a deliberate attempt to gain user trust and harvest cryptocurrency‑related credentials or funds. Uncertainty remains regarding the specific payload or phishing pages that may have been served before takedown, as no visual evidence is available. Defenders should continue to block the domain and its associated IP, monitor for any re‑registration or similar domain variations, and update detection rules to include the observed fingerprint of Cloudflare‑served, brand‑impersonating sites with the "Pump" page title. Continuous threat‑intel feeds should be consulted for any resurgence of this infrastructure.