register-pumpbank[.]fun

Analysis of register-pumpbank.fun indicates that the domain was registered on 30 December 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com. The site resolved to the IP address 172.67.161.134, which is part of Cloudflare, Inc. (AS13335) and geolocated to the United States. The TLS certificate presented is identified as WE1, and the page title returned by the server is “PumpBank | Airdrop”. The content is associated with an Airdrop Scam kit and explicitly impersonates the Revolut brand, classifying the operation as a crypto‑related brand‑impersonation campaign. VirusTotal recorded detections from 2 of 95 security vendors, and the domain appears on a single security blocklist.

PhishDestroy has already taken the site offline, and Gridinsoft assigns a trust score of 0 out of 100. The overall risk level is marked as elevated. The domain is currently listed as offline, and its presence on only one security blocklist suggests limited exposure at the time of takedown. The elevated risk rating reflects the combination of brand impersonation and crypto‑scam tactics, which have historically yielded high conversion rates.

The available evidence confirms the use of legitimate CDN infrastructure (Cloudflare) to host the malicious payload, which can obscure the true origin of the operators. While the site is currently offline, the registration details and the short lifespan suggest a fast‑flux style deployment that may be re‑used with new domains. Defenders should add the domain and its resolving IP to existing blocklists, monitor for similar Airdrop‑related page titles, and enforce strict outbound filtering for traffic to Cloudflare‑served IPs that are flagged by multiple vendors. Continuous observation of newly registered domains using the same registrar and similar naming patterns is recommended to pre‑empt re‑deployment of the campaign.