Is ipump.fan a scam? TrustSniffer's high-risk assessment: 1/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website at ipump.fan is a single-page front end whose browser title reads "pump.fun", a name that differs from the domain it is served from. It presents a short homepage and no other substantive pages were captured. Its apparent purpose is to pass as, or ride on, a well-known crypto token-launch brand. The page text and operator identity could not be independently tied to any real-world entity.

Scam/Impersonation Risk

Contradictory signals are present and material. Multiple independent threat-intelligence sources currently flag the domain as malicious, and the combined detections are strong enough to count as a confirmed blacklisting. Reputation records also carry a phishing association for the domain. The homepage title adopts the name of an established crypto platform while the domain is a different, lookalike string. This is the classic pattern of brand-adjacent lure sites that draw users into wallet or credential interactions. No separate conflicting legal entities were observed, and the sandbox saw no wallet-connect prompts, clipboard tampering, hidden forms or third-party data posts in the sessions run. That reduces the evidence of active drainer behaviour but does not offset the reputational findings. The domain's extreme newness and thin history point the same way, as do the repeated front-end errors during interaction. A lure site that stays quiet until a user engages is a realistic scenario here. Evidence:

• Homepage: the page title reads "pump.fun" while the serving domain is ipump.fan, a name mismatch consistent with lookalike behaviour.
• Domain registered 2026-09-03 (~0.14 years, about 52 days old) via NICENIC INTERNATIONAL GROUP CO., LIMITED.
• Web archive holds only 3 snapshots, from 2026-09-03 to 2026-09-22 (1 year tracked), so there is no established history.
• Behavioural sandbox, 3 of 3 runs completed: 0 external requests, no wallet-connect activity, 9 console errors, and a bot-protection challenge in front of the page.

Regulatory Verification Notes

No licensing, registration or legal-entity information is disclosed on the captured page. Real-world operator identity is not independently verified, and registration records show incomplete ownership details, which amounts to ownership opacity. A missing licence does not on its own indicate fraud. Here it adds to a profile that already carries confirmed adverse reputation signals. No third-party broker or regulatory-database entry matches the site, so there is no external attestation of legitimacy. The valid but low-assurance transport certificate confirms only an encrypted connection, not the identity of the operator. Evidence:

• Homepage: no company name, licence number, jurisdiction or legal pages were identified.
• Hosting: AS214036 (Ultahost, Inc.), registry AFRINIC, country ZA.
• TLS certificate issued by YR1 (DV, domain-validated only), valid to 2026-12-06 with about 42 days remaining.
• No broker or regulatory-database match was found for the site or brand.

What to Verify Next

Any contact with the genuine platform should start from an official address obtained independently, such as a bookmark, an official social account verified through the platform's own channels, or a trusted directory. Do not follow links from this domain. Anyone who has already interacted with the site should review wallet approvals and revoke any unfamiliar permissions. They should also change reused passwords and report the domain to the impersonated brand's security channel. Official support channels should be confirmed offline before any further engagement. Evidence:

• Homepage: the title claims a brand identity that the domain does not independently support.
• The domain was registered about seven weeks before this assessment, so no long record exists to vouch for it.
• Reputation findings are current, so any earlier interaction should be treated as potentially exposed.

Summary Verdict

The evidence converges on a high-risk posture. Confirmed adverse reputation findings, a lookalike brand presentation and a newly created domain with no track record outweigh the few neutral technical signals, such as a valid certificate and quiet sandbox behaviour. Legitimacy is not supported, and the operator's identity is unverified.

Infrastructure Integrity

The site is served from a single IP address on a commodity data-center hosting network operated by Ultahost, registered in Africa with the server located in South Africa. No CDN or WAF was identified in the infrastructure data, although a bot-protection challenge was observed during browsing. No protective layer is evident that would offset the reputation findings. The hosting is generic, low-barrier, and shared with unrelated customers, so it neither supports nor confirms the operator's legitimacy.

Closing Assessment

The site should be treated as read-only at most, and preferably not visited at all. Do not enter credentials, connect a wallet, sign transactions or send funds. Reach the genuine platform only through independently confirmed official channels.