20pump[.]fun

The domain 20pump.fun was registered through NameSilo, LLC on 21 February 2026. It is hosted on Cloudflare’s network (ASN 13335) and resolves to the IP address 188.114.96.3, which is located in the United States. The authoritative nameservers are harvey.ns.cloudflare.com and kehlani.ns.cloudflare.com, indicating that the operator is leveraging Cloudflare’s DNS and CDN services. No TLS certificate was observed, and the site is currently taken offline, returning no HTTP response. The only visible artifact is the page title “Pump”, which does not provide additional context about the payload or user‑facing content.

Intelligence flags the domain as a crypto‑related scam that impersonates the financial‑services brand Curve. The classification derives from the supplied “brand target: curve” and “scam type: Crypto Scam”. The site appears on a single security blocklist and is listed as blocked by PhishDestroy. VirusTotal analysis shows that two of ninety‑three scanning engines flagged the domain, indicating limited but non‑trivial detection. The limited vendor detection may reflect the short operational window; the domain was active for less than five months before being taken offline.

The observable indicators—Cloudflare‑hosted IP, lack of TLS, brand‑impersonation metadata, and blocklist inclusion—provide sufficient evidence for defensive teams to treat 20pump.fun as malicious. Organizations should add the domain and its resolving IP to outbound filtering rules, monitor DNS queries for the two Cloudflare nameservers, and consider extending blocklists to cover the domain even though it is currently offline. Because the site’s content has not been captured, analysts should remain alert for re‑hosting attempts that reuse the same brand‑impersonation pattern or the same Cloudflare infrastructure. Ongoing surveillance of the IP address and associated nameservers is recommended to detect any future activation.