Is pumpfunlive.trade a scam? TrustSniffer's high-risk assessment: 20/100

Overview

The website at pumpfunlive.trade is a single-page web property titled "Pump" that sits on the uncommon ".trade" top-level domain. It was brought online only weeks ago and serves a landing page with a modest amount of text. The evidence does not establish what product or service it offers, so its business model cannot be determined from the material available.

Scam/Impersonation Risk

This is the decisive section of the assessment. The site is blacklisted by at least one external reputation source, which makes it a confirmed contradiction and not a soft signal. Other reputation checks pulled the same way. One security engine rated the domain malicious and several others rated it suspicious, which shows the listing is not an isolated flag. The domain's recency compounds the concern. It was registered about five weeks before analysis and has almost no archived history. Newly created domains with thin footprints are a common pattern for disposable or short-lived abuse infrastructure. No conflicting legal identities and no brand-impersonation finding were observed, so the concern rests on the reputation listing and the domain's youth, not on any identity contradiction. Behavioral testing of the homepage was uneventful. It made no external data submissions, showed no wallet-connection prompts, and no clipboard manipulation or hidden forms were detected. It produced a high number of console errors during the sessions. These observations reduce the likelihood of an active on-page exploit during testing but do not offset the external listing. A site can behave benignly under automated observation and still serve harmful content to real visitors. Evidence:

• Homepage and domain-level reputation: one threat-intelligence engine flagged the domain as malicious and three as suspicious, and an external blacklist hit was recorded.
• Domain registration: registered 2026-09-13 (~0.11 years old) through Global Domain Group LLC, behind a registrar privacy service.
• Web-archive depth: 2 archive snapshots spanning 2026-09-13 to 2026-10-13 (1 year tracked), which confirms a very short public history.
• Homepage behavior across three sandbox runs: no external requests, 18 console errors, and no wallet, clipboard, or hidden-form activity.

Regulatory Verification Notes

The analysis found no evidence that the site operates under a financial or other regulatory authorization. The independent broker-reputation dataset returned no match, and the evidence does not establish how the site presents its legal entity, terms, or licensing, so no regulatory standing can be assumed. The privacy-protected registration is an administrative characteristic and is not treated as an identity contradiction. Independent confirmation of who operates the site is absent, so any claim the site makes about itself should be treated as unproven. The transport-layer security is in place but proves nothing about the operator's legitimacy. The certificate is a basic domain-validated type, and these certificates are issued automatically to any domain holder. Evidence:

• Transport encryption: TLS certificate issued by YE2 (DV), valid to 2026-12-12 with 50 days remaining.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Third-party broker reputation: no matching entry was found, so there is no external regulatory or reputational record to rely on.

What to Verify Next

Before any engagement, confirm through an independent, offline route that the operator is a real, identifiable entity. Use official registries or a separately sourced contact channel for this, and do not use any contact details presented on the site itself. Users who arrived via a link, advertisement, or social-media message should check that the exact domain was published by an organization they already know through an independent source. If the site is being evaluated for organizational use, it should be submitted to an internal security team for a controlled review before any access is allowed. Evidence:

• Homepage: the page captured shows no identity detail that could be matched to a known organization.
• Domain registration: a registration five weeks old gives no track record that could substitute for independent confirmation.
• External reputation: the unresolved malicious and suspicious detections should be re-checked against current listings before any decision to engage.

Summary Verdict

The overall posture is elevated risk. External threat detections decisively outweigh the neutral on-page behavior, and the domain has too little history to counterbalance them. Legitimacy is not supported by the available evidence, and the real-world operator remains unidentified.

Infrastructure Integrity

The site is fronted by Cloudflare's CDN and WAF, and all observed addresses are edge servers. The origin host was not visible, so the actual hosting location cannot be independently checked. This arrangement is a mild mitigating factor because it provides baseline protection and bot filtering. It also limits direct visibility and can mask rapid content changes behind the same edge addresses. Protective infrastructure cannot offset the reputation risk and does not indicate that the operator is legitimate.

Closing Assessment

Account login, credential entry, wallet connection, and any payment or financial interaction with this site should be avoided. At most, it should be viewed read-only from an isolated environment, and nothing should be downloaded from it. Organizations should consider blocking the domain until its reputation status is independently cleared.