pump-claims[.]web[.]app

This domain, pump-claims.web.app, is actively engaged in brand impersonation targeting Revolut, a financial services provider. The threat type is classified as a high-risk fraudulent airdrop scheme, designed to deceive users into disclosing sensitive account credentials or transferring assets under false pretenses. As of the latest assessment, the domain remains operational and unmitigated. Analysis indicates that pump-claims.web.app is flagged by 3 of 95 security vendors on VirusTotal, reflecting limited but concerning detection coverage. The domain is registered through Google LLC and resolves to the IPv6 address 2620:0:890::100, hosted on infrastructure belonging to AS54113 (Fastly, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WR4), a legitimate provider, which may reduce user suspicion during initial interaction. The domain appears on two security blocklists, including PhishDestroy and ScamSniffer, further corroborating its malicious classification. The page title, 'PUMP FUN | AIRDROP,' is crafted to exploit trending cryptocurrency themes and lure victims into engaging with the fraudulent content. Current infrastructure remains active, with no evidence of takedown or remediation efforts. Users and organizations are advised to block access to the domain at the network level and update endpoint protection rules to include the resolved IP address. Financial institutions and cryptocurrency platforms should proactively warn users about fraudulent airdrop schemes impersonating legitimate services. Monitoring for additional domains registered under similar patterns or resolving to the same infrastructure is recommended to preempt further abuse.