pumpfunairdrops[.]fun

The domain pumpfunairdrops.fun is a phishing site engaged in brand impersonation, specifically targeting Discord users. It presents itself as a legitimate airdrop associated with Pump.fun but is designed to deceive victims into connecting wallets, leading to potential credential theft or unauthorized transactions. No drainer kit was identified in this campaign. The site is currently taken offline, reducing immediate risk, but prior visitors may remain vulnerable to follow-up attacks.

Technical analysis of pumpfunairdrops.fun reveals limited detection, with 2 of 95 VirusTotal security vendors flagging the domain, including Gridinsoft and Trustwave. The domain was registered through NameCheap, Inc. on July 16, 2025, and resolves to the IP address 198.54.125.92, hosted by Namecheap, Inc. in the US. It appears on one security blocklist, PhishDestroy, and lacks an SSL certificate. The observed page title was 'Pump.fun - Airdrop', reinforcing its fraudulent intent to mimic legitimate services.

Individuals who interacted with pumpfunairdrops.fun should immediately revoke any token approvals granted to unknown contracts and consider transferring funds to a new wallet to mitigate potential losses. If credentials were entered, change passwords for Discord and any other reused accounts, enable two-factor authentication, and monitor for unauthorized activity. Report the phishing domain to Discord’s official abuse channels and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in broader takedown efforts.