v2-pumpswap[.]org

Analysis of v2-pumpswap.org indicates active infrastructure supporting a brand impersonation campaign targeting Solana users. The domain was registered on 26 April 2026 through Dynadot Inc and resolves to IP 176.125.242.151, an address hosted by Alexhost SRL in MD. DNS resolution uses ns1.dyna-ns.net and ns2.dyna-ns.net. The site serves content over HTTPS with a Let’s Encrypt R12 certificate and returns HTTP 200, presenting the page title "PumpSwap | Solana DeFi". Threat intelligence sources have recorded the domain on three blocklists and it is listed in a single AlienVault OTX pulse. It is currently blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans show three of ninety‑one security vendors flag the domain, and Gridinsoft assigns a trust score of zero out of one hundred. The combination of recent registration, dedicated hosting, and active blocking suggests a deliberate attempt to lure Solana participants. Uncertainty remains regarding the specific payload or credential‑capture mechanisms, as the page content has not been examined. Defenders should add the domain and its associated IP to outbound and inbound filtering rules, monitor DNS queries for the listed nameservers, and treat any connections to the site as malicious. Continued observation of blocklist updates and any future threat‑intel pulses is recommended.