buypump[.]pages[.]dev

This domain, buypump.pages.dev, is identified as a crypto drainer, a specialized form of phishing targeting cryptocurrency wallets. Analysis indicates no direct brand impersonation, but the site employs deceptive tactics to trick users into connecting wallets, likely through fake token airdrops or liquidity pool scams. The presence of SweetAlert2 and crypto-js in the detected technologies suggests interactive prompts and cryptographic operations designed to facilitate unauthorized transactions, a hallmark of drainer kits like Angel Drainer or Inferno Drainer.

Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on April 13, 2026, with an SSL certificate issued by Google Trust Services. It resolves to the IP address 172.66.44.144, a Cloudflare-hosted endpoint. VirusTotal reports 14 out of 95 security vendors flagging the domain as malicious, while it appears on 5 distinct security blocklists. The domain has a Gridinsoft trust score of 0/100, and no entries were found in Google Safe Browsing at the time of analysis. The page title, 'Pump,' aligns with common social engineering themes in crypto scams, often leveraging FOMO (fear of missing out) to prompt hasty user actions.

As of the latest assessment, buypump.pages.dev has been taken offline, likely due to enforcement actions by the hosting provider or registrar. The domain is actively blocked by multiple security tools, including MetaMask, PhishDestroy, SEAL, ScamSniffer, and Maltrail. Despite its current offline status, the domain remains a high-risk indicator due to its recent activity and the persistent threat posed by similar drainer infrastructure. Users are advised to revoke any wallet permissions granted to this domain, monitor transaction histories for unauthorized activity, and verify the legitimacy of any cryptocurrency-related offers through official channels before interaction.