christmas-pump[.]fun

This domain, christmas-pump.fun, is flagged as a high-risk brand impersonation phishing domain targeting the cryptocurrency platform Pump.fun. The domain was created on December 14, 2025, and remains active as of July 12, 2026. It resolves to IP address 104.21.6.79, hosted in the United States by Cloudflare (AS13335). The nameservers matias.ns.cloudflare.com and venus.ns.cloudflare.com, along with technologies including HSTS and HTTP/3, indicate standard Cloudflare proxying. SSL certificate is issued by Google Trust Services. The domain is registered through NiceNIC International Group Co., Limited. Analysis shows the page title is 'Just a moment...' and returns HTTP status 403, suggesting the server may be using Cloudflare's challenge page or blocking direct access. The domain appears on two security blocklists and is blocked by PhishDestroy and ScamSniffer. VirusTotal reports 3 of 95 security vendors flagging this domain as malicious. The Gridinsoft trust score is 0/100, reinforcing the threat assessment. Defenders should block this domain at network and email gateways, investigate any user interactions for credential or cryptocurrency theft, and monitor for similar domains leveraging the Pump.fun brand. The exact content of the site has not been visually confirmed, but the technical indicators strongly support a phishing operation.