pumpfunhub[.]click

PhishDestroy identifies pumpfunhub.click as an active crypto drainer phishing domain posing as a Pump.fun interface. The domain leverages a spoofed branding strategy to deceive users into connecting cryptocurrency wallets under the guise of token purchases or staking opportunities. While no specific drainer kit fingerprint is publicly available, the site's operational behavior aligns with typical web3 phishing campaigns that intercept wallet transactions via malicious smart contract approvals or clipboard hijacking scripts. The threat vector targets users familiar with Pump.fun, a legitimate Solana-based token launch platform, aiming to exploit trust in established web3 infrastructure. This domain was flagged with VirusTotal showing 1 out of 95 detection engines flagging the URL as malicious as of the latest scan. Technical indicators include registration through Sav.com, LLC, resolution to IP 172.67.173.15, and nameservers sima.ns.cloudflare.com and zac.ns.cloudflare.com. The domain was created on April 15, 2026, indicating a very recent setup designed for short-lived campaigns. Google Safe Browsing has not yet blacklisted the domain, and no third-party blocklist entries are recorded. These factors suggest the domain is designed to evade early detection mechanisms while remaining operational for active phishing campaigns. As of the latest intelligence, pumpfunhub.click remains active and unblocked across major security platforms. Immediate action is recommended to block the domain at the network and endpoint levels, including adding it to DNS sinkholes and firewall rules. Users should avoid visiting the site and report any interactions to their security teams or through platforms like PhishDestroy. Given the domain’s recent registration and low detection coverage, the remaining risk is assessed as high for targeted phishing attacks, particularly for users involved in cryptocurrency transactions. Continuous monitoring is advised as detection signatures evolve.