pumpfun-promotion[.]info

Analysis of pumpfun-promotion.info indicates that the domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is currently taken offline. The site resolved to the IP address 188.114.97.3, which is assigned to AS13335 Cloudflare, Inc. and geolocated to the United States. DNS resolution is served by the Cloudflare nameservers kyrie.ns.cloudflare.com and wanda.ns.cloudflare.com, suggesting the use of Cloudflare’s CDN and protection services. No TLS certificate was observed for the domain, meaning traffic would have been delivered over HTTP only. The page title returned by the server was "Pump.fun - Airdrop," and the underlying phishing kit has been identified as an "Airdrop Scam" kit, a known template used to harvest credentials related to airdrop promotions. The campaign targets Discord users, as indicated by the impersonated brand field, and is classified as a social media phishing operation.

Threat intelligence feeds have recorded the domain on two security blocklists and it has been explicitly blocked by PhishDestroy and ScamSniffer. AlienVault OTX references the domain in a single pulse, and Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal scans show that five of ninety‑three security vendors flagged the domain, reinforcing the detection consensus. The combination of a low trust score, presence on blocklists, and detection by multiple vendors underlines the domain’s elevated risk posture.

Uncertainties remain regarding the current content of the site, as it is offline and no SSL/TLS fingerprint or detailed payload analysis is available. The exact phishing vector (e.g., credential‑stealing form, malicious download) has not been observed, and the extent of compromised accounts is unknown.

Defenders should continue to block pumpfun-promotion.