Is lootool.lol a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a minimal crypto-themed landing page on a ".lol" domain. It presents itself under the Pump.fun name, a memecoin launchpad brand. The only content a visitor sees is an empty livestream viewer reading "No stream selected" with a "Go Back" button. It has no forms, links, product claims or stated terms. Its apparent purpose is to front a memecoin token-trading or launchpad service, but the page itself does not evidence any such function.

Scam/Impersonation Risk

Contradictory signals are present, and they are decisive. Several independent reputation sources currently flag this domain as malicious, and the domain has been confirmed as blacklisted. A multi-engine scan found five detections, including one from a major network-security vendor, and the history record carries a known-phishing marker. The homepage shows the Pump.fun name in its title and text, but the domain has no visible connection to that brand. The content analysis did not confirm brand impersonation, so this is a naming mismatch rather than a proven spoof. Combined with the blacklisting, it is a material concern, because a thin page wearing a well-known launchpad's name is a common pattern for wallet-draining or credential-harvesting fronts. The sandbox runs observed no wallet-connection prompts, clipboard tampering, hidden forms or external data posts. This is mildly reassuring, but the page is so empty that the absence of malicious behaviour says little about what the site could serve later. The site should be treated as high-risk for any sensitive interaction. Evidence:

• Homepage: the only visible text is "Pump.fun / No stream selected / To view the stream, please go back to the previous page / Go Back", served from an unrelated ".lol" domain.
• Reputation checks: five engines flag the domain as malicious, and it is confirmed on an external blacklist.
• Domain provenance: registered 2026-04-05 (~0.5 years old), through registrar Global Domain Group LLC.
• Web archive: 1 snapshot, in 2026 (1 year tracked), so there is no established history.

Regulatory Verification Notes

The site claims no licence, registration number, regulator or legal entity. The captured page has no legal, terms, about or contact content at all, so there is no on-site basis for connecting the domain to a real-world operator. Ownership details for the domain are incomplete and the operator's identity remains unverified. This is an ownership and governance opacity issue, not a contradiction between identities, because no conflicting legal entities appear. No third-party broker or regulator-style entry matches this domain. A memecoin launchpad is a token-trading service, and a legitimate one would normally be expected to publish operator, terms and jurisdictional disclosures. None are present here. Evidence:

• Homepage: no licence, company name, registration number or jurisdiction is displayed, and no terms or privacy pages are reachable from the captured page.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: the TLS certificate is issued by WE1 at domain-validated (DV) level, valid to 2026-12-13. This confirms encryption only and says nothing about the operator's identity.
• Third-party broker dataset: no match for this domain.

What to Verify Next

The link between this domain and the Pump.fun brand should be checked against the brand's officially published addresses and social channels, reached independently rather than through this site. Any claim of affiliation should be treated as unsupported until the brand itself confirms it. If the site later offers token creation, trading, wallet connection or support contact, each channel should be confirmed through an independent route before any interaction. The blacklisting status should be rechecked on the reputation sources after a reasonable interval, since listings can reflect either deliberate abuse or a later clean-up. Evidence:

• Homepage: no link, contact route or official-channel reference exists to cross-check, so the brand relationship cannot be validated from the site.
• Reputation checks: the active malicious detections are the main item to re-test.
• Domain provenance: a registration of roughly half a year provides no track record to weigh against the flags.

Summary Verdict

The overall posture is high-risk. Confirmed blacklisting and multiple malicious detections, together with a very young domain, an unverified operator and a brand name that does not match the domain, outweigh the technically sound transport security and clean sandbox behaviour. The site is suitable at most for passive, read-only viewing.

Infrastructure Integrity

The site is fronted by Cloudflare's CDN and WAF, and every observed address is a Cloudflare edge address. The origin server is not observable, so hosting cannot be independently attributed and content could be swapped quickly behind the edge. This protection is a mitigating factor only. It does not offset the reputation findings, and it neither shows nor implies that the operator is legitimate.

Closing Assessment

Do not log in, connect a wallet, submit credentials or make any payment or token transaction through this site. Use it, if at all, only for passive viewing, and reach the Pump.fun brand only through its independently confirmed official channels.