pumlp[.]fun

On July 24, 2026, analysis of the domain pumlp.fun shows that it was created on March 06, 2026 and is currently taken offline. The site presented a page title of “Pump”, but no SSL certificate was observed during the scan. DNS resolution points to the IP address 104.21.82.114, which belongs to Cloudflare, Inc. (AS13335) and is geolocated to the United States. The domain is registered through NameSilo, LLC and uses the Cloudflare nameservers magdalena.ns.cloudflare.com and rohin.ns.cloudflare.com.

Independent threat‑intelligence feeds have listed pumlp.fun on three blocklists, specifically PhishDestroy, MetaMask, and SEAL, indicating that multiple security vendors have observed malicious activity associated with this host. VirusTotal’s latest scan recorded a single positive detection out of 95 security vendors, reinforcing the suspicion of abuse. No HTTPS certificate was present, which is consistent with the rapid takedown observed for many phishing infrastructure. The available evidence confirms that pumlp.fun functioned as a phishing‑type site, although the exact commodity or credential‑stealing mechanism has not been disclosed beyond the generic “Pump” page title.

Because the domain is presently offline, active exploitation is unlikely, but the underlying hosting infrastructure (Cloudflare) may be reused for future campaigns. Defenders should continue to block the domain at perimeter firewalls and DNS filters, add the associated IP address to threat‑intel watchlists, and monitor for any re‑registration of the same name or similar‑looking domains. Continuous ingestion of blocklist updates from PhishDestroy, MetaMask, and SEAL is recommended to capture potential re‑emergence. Additionally, security teams should verify that internal logs do not contain recent requests to the IP 104.21.82.114, which could indicate lingering activity before the takedown.