pump[.]fun-web3-connect-app[.]com

The domain pump.fun-web3-connect-app.com was registered on 21 February 2026 and is actively serving a page that returns HTTP 403. The site is listed as a brand‑impersonation campaign targeting the Pump.fun brand and is classified as a cryptocurrency‑related scam.

Technical infrastructure shows the domain resolves to IP address 172.67.180.9, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. No TLS certificate is presented, and the HTTP response lacks a valid certificate chain. The registrar is GMO Internet Group, Inc. operating under the Onamae.com brand, and the authoritative nameservers are ns1.verification-hold.suspended-domain.com and ns2.verification-hold.suspended‑domain.com.

VirusTotal analysis flags the domain in 14 of 95 security engines, indicating a notable detection rate. Independent blocklists such as PhishDestroy and ScamSniffer have already added the domain, and the Gridinsoft trust score is 0 out of 100. Both factors, combined with the high‑risk rating, suggest a deliberate malicious intent.

Because the server returns a 403 status, the actual landing page content cannot be retrieved, leaving the specific phishing payload or malicious scripts unknown. The absence of SSL also prevents inspection of any encrypted traffic that might be used in later stages of the attack.

Defenders should immediately block pump.fun‑web3‑connect‑app.com at network perimeter and DNS layers, add the associated IP 172.67.180.9 to deny lists, and monitor for any new sub‑domains under the same registrar or nameserver pattern. Continuous re‑scanning of the domain is advised to capture any changes in content or certificate deployment.