pump-gift[.]fun

The domain pump-gift.fun was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is served from Cloudflare’s network (nameservers quinton.ns.cloudflare.com and tani.ns.cloudflare.com). DNS resolution points to IP 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presented a TLS certificate issued by Google Trust Services under the WE1 root, confirming the use of HTTPS. Traffic was observed over HTTP/3, indicating modern CDN delivery.

The only visible page title was “Pump.fun – Airdrop”, and the infrastructure is associated with an “Airdrop Scam” kit that targets Discord users through wallet/seed phishing. The page title and kit suggest the attacker attempts to lure victims with a fake airdrop, requesting Discord‑related credentials or cryptocurrency seed phrases. VirusTotal recorded detections from 2 of 93 scanning engines, and the domain appears on a single security blocklist (PhishDestroy). The current operational status is offline, but the hosting and certificate remain active, allowing rapid re‑activation.

No additional public reputation sources such as Google Safe Browsing or OTX were cited in the available intelligence. Defenders should add pump-gift.fun to blocklists at the DNS and proxy level, monitor for any resurrection of the site, and enforce strict verification of Discord‑related communications, especially any unsolicited airdrop offers. Because the infrastructure relies on Cloudflare, similar future campaigns may reuse the same nameserver configuration; security teams should watch for new domains registered with NiceNIC that resolve to Cloudflare IPs and present Discord‑oriented content. Continuous threat‑intel feeds should be consulted for updates on the Airdrop Scam kit, and incident response playbooks should include steps for handling wallet or seed‑phrase phishing attempts.