soi-meme[.]com

This domain, soi-meme.com, poses as an official security alert page for Pump.fun, a decentralized application platform, with the intent to deceive users into disclosing credentials or authorizing malicious transactions. The page title "Account Security Alert - pump.fun" mimics legitimate security notifications, increasing the likelihood of successful social engineering. Analysis indicates the domain is designed to harvest login details or deploy crypto-draining scripts, a common tactic in brand impersonation attacks targeting cryptocurrency users.

Technical evidence confirms the domain's malicious nature. soi-meme.com is flagged by 14 out of 95 security vendors on VirusTotal, indicating broad detection across multiple threat intelligence sources. The domain was registered on March 29, 2026, through Global Domain Group LLC, a registrar frequently associated with abusive registrations. It appears on three security blocklists and resolves to the IP address 104.21.25.120, which is proxied through Cloudflare. Detected technologies include Node.js, Vue.js, and Nuxt.js, suggesting a sophisticated frontend designed to replicate the target platform's interface. The domain is currently offline but was actively blocked by MetaMask, PhishDestroy, and SEAL prior to takedown.

Users who visited soi-meme.com should assume their credentials or session tokens may have been compromised. Immediately revoke any active sessions or connected wallet authorizations associated with Pump.fun or similar services. Monitor accounts for unauthorized transactions and enable multi-factor authentication where available. If cryptocurrency transactions were initiated, check wallet addresses for anomalies and consider migrating assets to a new wallet. Report the incident to relevant security teams and block the domain across all devices to prevent accidental re-exposure. Given the high-risk nature of this threat, affected users should conduct a full security review of their digital assets and connected applications.