pumpairdrop[.]info

The domain pumpairdrop.info has been identified as a brand impersonation threat specifically targeting Revolut, a financial services provider. Analysis confirms this domain was designed to mimic legitimate airdrop promotions, a common tactic used to deceive users into disclosing sensitive account credentials or transferring funds under false pretenses. As of the latest assessment, the domain is reported offline, though prior activity remains a concern for historical exposure. Infrastructure analysis reveals pumpairdrop.info was flagged by 2 of 95 security vendors on VirusTotal, indicating limited but confirmed detection of malicious intent. The domain resolves to the IP address 172.67.203.27 and was registered through Cloudflare, Inc., a provider frequently leveraged by threat actors to obscure ownership and hosting details. It appears on two independent security blocklists, including PhishDestroy and ScamSniffer, further corroborating its fraudulent nature. The page title, PUMP FUN | AIRDROP, directly references a fabricated promotion, a tactic often employed to exploit user trust in cryptocurrency or financial reward schemes. Given the domain's current offline status, immediate interaction risks are mitigated; however, historical exposure and residual threats persist. Users who may have engaged with this domain are advised to monitor financial accounts for unauthorized activity, reset credentials for any associated services, and report the incident to their financial institution. Organizations are recommended to update internal blocklists to include this domain and its associated IP address, while security teams should conduct retrospective log analysis to identify any prior compromise indicators. Proactive monitoring of newly registered domains with similar naming patterns is also advised to preempt future impersonation attempts.