pumpfun-promo[.]com

This domain, pumpfun-promo.com, poses as a promotional airdrop for the platform Pump.fun but is designed to impersonate Discord login pages. Users visiting the site are prompted to enter credentials or connect wallets under the guise of claiming rewards, which are then harvested by threat actors. The site specifically targets communities familiar with crypto airdrops, exploiting trust in the Pump.fun brand to facilitate credential theft or unauthorized transactions. Analysis indicates the domain was registered on November 24, 2025, through NiceNIC International Group Co., Limited. It resolves to the IP address 188.114.96.3 and is flagged by 4 out of 95 security vendors on VirusTotal. The page title, 'Pump.fun - Airdrop,' directly mimics legitimate promotional content, and the domain appears on two security blocklists. Infrastructure review confirms it was taken offline following detection, though similar domains may remain active. If you visited pumpfun-promo.com, immediately revoke any wallet connections or sessions linked to the site. Change passwords for Discord and any associated accounts, and enable multi-factor authentication if not already active. Monitor financial transactions for unauthorized activity, particularly if wallet credentials were entered. Report the domain to Discord’s security team and consider scanning your device for malware, as some phishing pages deploy additional payloads. Avoid interacting with unsolicited airdrop promotions, especially those requiring immediate credential input or wallet access.