register-pump2026[.]fun

register-pump2026.fun was observed hosting a page titled “Nur einen Moment…”. The site was blocked by PhishDestroy and returned HTTP 403 at the time of collection. DNS resolution points to 188.114.96.3, an address owned by Cloudflare (AS13335) located in the United States. The domain uses Cloudflare’s DNS service with the authoritative name servers gabriella.ns.cloudflare.com and pablo.ns.cloudflare.com, and the web server presented a Google Trust Services / WE1 TLS certificate, indicating a valid certificate chain issued by Google. The site advertised HSTS and HTTP/3, consistent with modern Cloudflare deployments.

The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited. VirusTotal recorded detections from 2 of 93 scanners, confirming that at least two security products flagged the host as malicious. The domain appears on a single public blocklist, and the blocklist entry is reflected in the PhishDestroy feed that triggered the 403 response. The current operational status is offline, suggesting the hosting provider or the blocklist takedown has removed active content. Analysis confirms the presence of a phishing indicator set – the combination of a suspicious page title, Cloudflare‑hosted IP, and detection by multiple vendors aligns with typical phishing infrastructure.

However, no further content details, such as targeted brand or credential‑capture page, are available from the collected data, leaving the exact lure unknown. Defenders should continue to block the domain at perimeter filters, update DNS sinkhole entries with the observed nameservers, and monitor for any re‑registration attempts. Additional scrutiny of traffic to 188.114.96.3 is advised, as the IP may host other malicious actors under the same Cloudflare tenancy. Continuous re‑scanning on VirusTotal and inclusion in internal blocklists will maintain coverage while the offline status persists.