votecoin-pump[.]fun

Analysis on votecoin-pump.fun indicates a newly registered domain created on 27 February 2026 that is being used to impersonate the legitimate Pump.fun service. Registration was performed through NiceNIC International Group Co., Limited and the domain resolves to the Cloudflare edge address 104.21.94.108, which is associated with AS13335 in the United States. The site does not present a valid SSL certificate, and the HTTP response returns a generic page title “Just a moment…”, suggesting the use of Cloudflare’s challenge page rather than a purpose‑built phishing landing page. Infrastructure evidence shows the domain is hosted on Cloudflare’s DNS, using the authoritative nameservers lynn.ns.cloudflare.com and walk.ns.cloudflare.com.

Reputation data is poor: the Gridinsoft trust score is 0 out of 100, and three independent security blocklists (PhishDestroy, MetaMask, and SEAL) have already listed the domain. VirusTotal scans report that three of ninety‑three AV engines flag the domain, reinforcing the suspicion of malicious intent. The domain is also classified as a crypto‑related scam, matching the brand‑impersonation profile targeting Pump.fun users. Because the site is currently offline, direct interaction is not possible, but the observable indicators confirm a high likelihood of credential or wallet theft attempts.

Uncertainty remains regarding the exact payload or phishing flow, as no content beyond the Cloudflare challenge page has been captured. Defenders should block the domain at the network perimeter, add it to URL filtering policies, and monitor for any DNS queries to the associated Cloudflare IP range. Continuous re‑evaluation is advised in case the site becomes active again, and any related indicators of compromise should be shared with threat‑intelligence platforms.