in-pump[.]fun

This domain, in-pump.fun, is identified as a confirmed brand impersonation phishing site designed to deceive users of the legitimate platform Pump.fun. The site specifically targets cryptocurrency enthusiasts by presenting a fraudulent airdrop page titled 'Airdrop Live - Claim Solana token airdrops,' a common tactic to lure victims into disclosing wallet credentials or approving malicious transactions. Analysis indicates the domain is engineered to harvest sensitive information or deploy crypto drainers, which automatically siphon funds from connected wallets without user consent. The threat is particularly acute given the rising prevalence of Solana-based scams and the domain's explicit focus on this blockchain network. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on March 05, 2024, through Porkbun LLC, a registrar frequently associated with newly created phishing sites. It resolves to the IP address 104.21.82.231 and employs Cloudflare for content delivery, a technique often used to obscure the true origin of malicious infrastructure. Security vendors on VirusTotal flagged the domain as malicious, with 13 out of 95 detections confirming its fraudulent nature. Additionally, the domain appears on three security blocklists and is actively blocked by multiple browser-based security extensions, further validating its classification as a high-risk threat. The use of HTTP/3 and Cloudflare Browser Insights suggests an attempt to mimic legitimate sites while evading detection. Users who visited in-pump.fun or interacted with its content should take immediate action to mitigate potential risks. First, disconnect any wallets that were linked to the site and revoke all token approvals via a blockchain explorer or wallet management tool. Scan the device used to access the domain for malware, as phishing sites often deploy secondary payloads. Monitor connected wallets for unauthorized transactions and report any suspicious activity to the relevant blockchain network or security community. Given the domain's current offline status, users should remain vigilant for similar scams, particularly those impersonating cryptocurrency platforms or offering fake airdrops. Always verify the authenticity of airdrop claims through official channels before engaging with any external links.