pumpcoin[.]run

pumpcoin.run was registered on 21 February 2026 and resolves to the IPv6 address 2606:4700:3037::ac43:9e2e, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presented the page title “Pump.fun - Airdrop”, a typical lure used by the publicly documented “Airdrop Scam” phishing kit. The kit is known to target social‑media accounts, and in this instance the domain is flagged as impersonating the Discord brand, indicating a likely attempt to harvest Discord credentials through a fabricated airdrop offering. VirusTotal records show that three of ninety‑three scanning engines flagged the domain, providing early detection of malicious activity.

The domain appears on a single external blocklist and has been added to the PhishDestroy blacklist, reinforcing the classification as a malicious resource. AlienVault OTX lists the domain in one threat‑intel pulse, further corroborating its association with known malicious campaigns. The SSL certificate associated with the site is labeled “WE1”, and the Gridinsoft trust score for the domain is 0 out of 100, reflecting an extremely low reputation. The site is currently offline, but the historical evidence suggests the infrastructure was deliberately deployed to exploit Discord users via a social‑media phishing vector.

Defenders should continue to block the domain and its resolving IP at perimeter and DNS filters, monitor for any resurgence of the host, and inspect logs for attempts to contact the address. Additional mitigation includes enforcing multi‑factor authentication on Discord accounts and educating users about unsolicited airdrop offers that reference Pump.fun. Further analysis is limited by the lack of live content; investigators should seek archived snapshots if available to validate the exact phishing page layout.