puqp[.]fun

This domain, puqp.fun, is actively impersonating Pump.fun, a known cryptocurrency platform, as part of an airdrop-themed phishing operation. Analysis indicates the site presents itself under the page title '{{TOKEN_NAME}} (${{TOKEN_SYMBOL}}) Airdrop | pump.fun,' directly targeting users expecting legitimate token distributions. The domain was registered on March 24, 2026, through Global Domain Group LLC and currently resolves to IP address 188.114.96.3, which is associated with Cloudflare infrastructure. Security vendors have flagged the domain, with 5 out of 95 detecting it as malicious, and it appears on five distinct blocklists, including SEAL, MetaMask, and PhishDestroy. The site employs a Let's Encrypt SSL certificate and utilizes Cloudflare Browser Insights and HTTP/3 technologies, which are common in both legitimate and malicious deployments. Threat intelligence platforms, including AlienVault OTX, have recorded the domain in 23 pulses, suggesting widespread recognition of its malicious intent. The Gridinsoft trust score of 0/100 further corroborates its classification as high-risk. While the exact content and functionality of the site remain unconfirmed, the presence of an airdrop-themed phishing kit aligns with common tactics used to harvest credentials or distribute malicious payloads. Defenders should treat this domain as an active threat, block it at the network level, and monitor for related indicators of compromise. No evidence suggests this domain is affiliated with the legitimate Pump.fun platform, and users should be advised to avoid interaction with it.