pumpfun-presale[.]pages[.]dev

PhishDestroy identifies pumpfun-presale.pages.dev as an active brand impersonation site targeting Pump.fun. The domain poses as a presale event for the legitimate Pump.fun platform, leveraging visual and linguistic cues to deceive users into connecting crypto wallets or revealing sensitive credentials. Unlike generic phishing campaigns, this threat employs crypto drainer tactics aimed at unauthorized fund extraction from cryptocurrency wallets. Preliminary analysis suggests the use of known drainer kits commonly distributed via fraudulent presale or giveaway pages, though deeper payload inspection is ongoing to confirm specific kit signatures and evasion techniques. This domain resolves to IP 172.66.44.92 and is hosted through Cloudflare, Inc., registered under Google Trust Services SSL certificates to enhance authenticity. The domain remains unflagged on VirusTotal with 0 detections out of 95 scanners, highlighting its stealthy infrastructure. While exact creation timestamps are still being verified, the page title ‘Pump’ aligns with the targeted brand, suggesting a recent deployment. The site remains active and accessible as of the latest scan, with no known inclusion in major blocklists such as Google Safe Browsing (GSB) or others. The absence of detections underscores the need for proactive monitoring and rapid ingestion into threat intelligence feeds. The threat remains under active investigation, with the domain currently live and operational. Users are strongly advised to avoid visiting or interacting with pumpfun-presale.pages.dev and to report any incidents involving unauthorized wallet connections or fund loss. Network defenders should consider blocking the domain at the DNS or firewall level and monitor for related infrastructure pivots. The residual risk remains elevated due to low detection coverage and high potential impact on cryptocurrency users. Immediate action is recommended to prevent further compromise.