pump[.]fun-wallet-dexv3[.]com

The domain pump.fun-wallet-dexv3.com was registered on February 21, 2026 through MAT BAO CORPORATION and is hosted behind Cloudflare’s network (AS13335, United States). DNS resolution points to 172.67.167.35 and the authoritative nameservers are chelsea.ns.cloudflare.com and huxley.ns.cloudflare.com. The site serves over HTTP/3 and presents a Google Trust Services / WE1 SSL certificate, indicating a valid TLS handshake despite the underlying malicious intent.

Technical probing returns an HTTP 403 response and the page title “fun-wallet-dexv3.com | 521: Web server is down”, suggesting the site is deliberately presenting a server‑down error page while its infrastructure remains active. The domain appears on two security blocklists—PhishDestroy and ScamSniffer—and VirusTotal records three of ninety‑five scanners flagging the domain as malicious. A Gridinsoft trust score of 0/100 further reinforces the low reputation of this host.

The primary threat vector is brand impersonation of Pump.fun, with the scam type identified as cryptocurrency. High‑risk classification is supported by the combination of a recent registration, active Cloudflare protection that can mask origin infrastructure, and multiple detections across commercial blocklists. Although the visible content is limited to a 521 error page, the presence of a brand‑specific subdomain and the cryptocurrency focus indicate an intent to lure victims into fraudulent financial interactions.

Defenders should proactively block pump.fun-wallet-dexv3.com at DNS and proxy layers, monitor outbound connections to its resolved IP, and include the domain in threat‑intel feeds. Continuous re‑resolution checks are advised because Cloudflare may change the underlying IP without notice. Further analysis of any payloads delivered through the domain, if it becomes active, will be necessary to confirm the exact phishing or drainer mechanisms employed.