vouchtiketpump[.]netlify[.]app

This domain, vouchtiketpump.netlify.app, is under investigation for brand impersonation targeting Pump.fun, a known decentralized application platform. Analysis indicates the site was hosted on Netlify infrastructure and presented itself as a Pump.fun airdrop page, as evidenced by the page title 'Pump.fun - Airdrop' and the scam type classified as a fake airdrop. The domain resolved to IP address 35.157.26.135, located in Germany under Amazon.com, Inc. (AS16509), and was registered through Netlify. The SSL certificate, issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), remains valid but does not mitigate the malicious intent of the domain. Infrastructure analysis reveals the domain is currently offline, returning an HTTP 404 status, and no nameservers were detected at the time of assessment.

The domain appears on one security blocklist, specifically PhishDestroy, which classified it as part of an airdrop scam phishing kit. While VirusTotal was scanned by 95 vendors, none currently flag the domain as malicious; however, the absence of detections does not confirm safety. The domain's association with Netlify hosting and the use of HSTS suggest an attempt to appear legitimate, though these technologies are commonly exploited in phishing campaigns. Defenders should treat this domain as high-risk for Pump.fun users, particularly those targeted by airdrop scams.

Monitoring for related domains or subdomains on Netlify or similar hosting platforms is recommended, as threat actors frequently reuse infrastructure. If the domain resurfaces, immediate takedown requests should be submitted to Netlify and relevant security vendors. Organizations should also review logs for connections to 35.157.26.135 or the domain name to identify potential compromise. Further analysis of the phishing kit, if recovered, may provide additional indicators of compromise.