pump-fun-board[.]pages[.]dev

PhishDestroy identifies the domain pump-fun-board.pages.dev as an active brand impersonation threat targeting the cryptocurrency platform Pump.fun. This fraudulent website is engineered to deceive users by replicating the branding, URL structure, and interface of the legitimate Pump.fun trading platform. The threat actor leverages Cloudflare’s pages.dev subdomain service to host the malicious site, which is designed to harvest login credentials, wallet addresses, or seed phrases from unsuspecting victims. While the domain does not currently utilize a known drainer kit, its sole purpose is to facilitate financial fraud by impersonating a trusted platform in the crypto space.

Technical indicators for pump-fun-board.pages.dev confirm its malicious intent and operational status. VirusTotal analysis shows 0 detections out of 95 engines as of the latest scan, indicating the domain remains undetected by most security tools. The domain resolves to IP address 188.114.97.3, which is hosted on Cloudflare infrastructure. The SSL certificate is issued by Google Trust Services, a tactic commonly used to lend false legitimacy to phishing sites. The domain was registered through Cloudflare, Inc., and the threat remains active. Google Safe Browsing (GSB) has not flagged the domain, and no known blocklists currently include it. This combination of factors makes the domain particularly dangerous, as it avoids detection while actively impersonating a legitimate service.

The current status of pump-fun-board.pages.dev is active, with no active takedowns or blocklists in place. Security researchers and users should immediately block the domain at the network level and report it to relevant authorities, including Google Safe Browsing and the targeted brand’s abuse team. Users should avoid accessing the site and verify any Pump.fun-related links through official channels. The remaining risk is considered high due to the domain’s undetected status and its direct impersonation of a popular cryptocurrency platform. Immediate action is required to prevent further victimization, as attackers may escalate their tactics or reuse infrastructure for additional fraudulent campaigns.