pump-pump[.]fun

Analysis of pump-pump.fun indicates a newly registered malicious site that impersonates the cryptocurrency analytics service dexscreener. The domain was created on 22 February 2026 and is hosted behind Cloudflare’s network, resolving to IP address 172.67.207.103, which belongs to AS13335 Cloudflare, Inc. in the United States. No TLS certificate was observed, confirming that the site operated without HTTPS encryption. The page title returned by the server reads “The Pumpfun Speedrun to 100M (SPEEDRUN) - Airdrop Live”, suggesting the use of an airdrop‑related phishing kit. The kit is identified as an “Airdrop Scam”, a known pattern for crypto‑related credential harvesting.

The registrar listed for the domain is REGRU‑RU, and the nameservers are aleena.ns.cloudflare.com and corey.ns.cloudflare.com, both Cloudflare‑managed. VirusTotal scans show that two of ninety‑five security vendors flagged the domain, indicating partial detection. Independent blocklist monitoring confirms that the domain is listed by PhishDestroy, MetaMask, ScamSniffer, and SEAL, and appears on four additional security blocklists. The Gridinsoft trust score of 0/100 further reflects a high confidence of malicious intent. The site has been taken offline as of the report date, but the infrastructure components remain active and could be reused for future campaigns.

Uncertainty remains around the exact content served before takedown, as no SSL certificate and no live HTTP response were captured. Defenders should continue to block the domain at network perimeter, monitor for any re‑registration of the same name or similar variations, and add the associated IP address 172.67.207.103 to deny‑list rules. Threat‑intel feeds should be updated to include the registrar REGRU‑RU and the Cloudflare nameservers as indicators of compromise. Continuous observation of the identified blocklists and the two vendor detections is recommended to capture any resurgence of the phishing kit.