pump-allocations[.]pages[.]dev

pump-allocations.pages.dev is a tenant hostname on Cloudflare, not a separately registered domain. PhishDestroy first observed the hostname on Dec 7, 2025. Stored content metadata identifies Revolut as the apparent target. The captured page title is “PUMP FUN | AIRDROP”. Page analysis recorded additional brand references to Telegram. Stored page analysis classifies the content as crypto drainer. Campaign clustering links the hostname to the Airdrop Scam kit. Current evidence score: 58/100 (high).

Positive findings are stored from 2 sources: VirusTotal and ScamSniffer. VirusTotal recorded 2 detections among 95 engines: Gridinsoft, Trustwave on Jul 18, 2026 at 18:45 UTC. ScamSniffer listed the hostname in the external-blocklist snapshot on Aug 8, 2026 at 02:20 UTC. Non-positive and contextual checks: URLQuery recorded no positive detection; no observation timestamp was retained. Google Safe Browsing returned no flag on Mar 3, 2026 at 04:14 UTC. URLScan completed without a malicious verdict on Jul 29, 2026 at 03:31 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 01:06 UTC; content was unavailable. Cloudflare is the hosting platform for this tenant, not its registrar. At collection time, the hostname resolved to 2606:4700:310c::ac42:2d08 on AS13335 (CLOUDFLARENET, US). The IP and ASN identify shared Cloudflare infrastructure, not the tenant operator. DOM analysis on Mar 24, 2026 at 01:23 UTC returned 25/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan.

The content indicators and 2 positive source findings support the current Revolut-themed crypto drainer classification.