pumqp[.]fun

Analysis indicates that the domain pumqp.fun was registered on 26 February 2026 through NameSilo, LLC. The authoritative nameservers kianchau.ns.cloudflare.com and tess.ns.cloudflare.com resolve the domain to the Cloudflare edge address 104.21.53.106, which is advertised as being located in the United States under ASN 13335 (Cloudflare, Inc.). No TLS certificate is presented for the site, implying that HTTPS connections are not available. The page title returned by HTTP requests is “Pump”, and the site has been classified as a generic phishing operation. Current operational status is offline, and the domain has been taken down by multiple mitigation services, including PhishDestroy, MetaMask, and SEAL.

VirusTotal scans show that one out of ninety‑three security vendors flagged the domain, and the domain appears on three independent blocklists. The lack of a valid SSL certificate, the recent registration date, and the reliance on Cloudflare’s shared infrastructure are consistent with typical phishing hosting patterns. However, the limited detection count and the absence of publicly disclosed payload or credential‑stealing pages leave the exact phishing vector uncertain. The presence on three blocklists suggests that multiple security vendors have independently observed malicious activity tied to this host.

No additional intelligence such as Safe Browsing alerts, OTX references, or kit signatures is available at this time. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑activation of the host IP, and consider adding the domain to internal blocklists. Ongoing observation of the associated IP and nameserver records is advised, as changes may indicate a new campaign launch. Because the site is already offline, immediate incident response actions focus on containment and ensuring that any previously harvested credentials are revoked.