pumps[.]pages[.]dev

Analysis of the domain pumps.pages.dev indicates that it is currently active and has been observed on a single security blocklist. The domain resolves to the IP address 172.66.45.44 and is hosted by Cloudflare, Inc., which also provides the authoritative name servers dale.ns.cloudflare.com and tessa.ns.cloudflare.com. The registration details show that the domain was provisioned through Cloudflare, confirming the use of a reputable registrar but also highlighting the ease with which threat actors can obtain infrastructure that benefits from built‑in DDoS mitigation and global Anycast routing. The domain has been flagged by the PhishDestroy blocklist, suggesting that at least one anti‑phishing feed has identified malicious activity associated with it.

Additionally, the domain was submitted to VirusTotal where 91 independent scanning engines evaluated the site; none of the engines reported a detection. While the absence of detections does not constitute a safety guarantee, it demonstrates that the payload or page content, if any, has not yet matched known signatures in those repositories. No public page title, brand target, or kit information is available, and the content of the site has not been publicly analysed, leaving the exact impersonation vector undefined.

Given the limited but concrete indicators—blocklist inclusion, Cloudflare hosting, and a clean VirusTotal scan—defenders should treat pumps.pages.dev as a high‑confidence phishing indicator. Recommended actions include adding the domain to outbound and inbound web filtering policies, monitoring DNS queries for the domain, and, where feasible, employing sandbox analysis of any retrieved content to confirm the presence of credential‑harvesting forms or malicious redirects. Continuous observation of threat‑intel feeds for updates on the domain’s activity is advised, as additional context such as page titles or brand targets may emerge with further investigation.