pump-coins[.]fun

The domain pump-coins.fun operates as a cryptocurrency phishing site, leveraging cloaking techniques to present benign content to security scanners while targeting unsuspecting users. Despite its recent creation on April 17, 2026, it has already been flagged by 2 out of 95 vendors on VirusTotal and is listed on 3 public blocklists, including PhishDestroy, MetaMask, and SEAL.

The site, hosted on Cloudflare's infrastructure in Canada, uses Let's Encrypt for SSL certification, which could lend it an appearance of legitimacy to potential victims. Its platform risk score is alarmingly high at 98 out of 100, indicating a significant threat level. The page title "View on Pump" suggests a lure for cryptocurrency enthusiasts, possibly enticing them to enter sensitive information under the guise of viewing or managing digital assets.

PhishDestroy detected this domain on April 20, 2026, shortly after its registration. The site's use of cloaking, with a score of 1 out of 10, reveals a deliberate strategy to evade detection by serving harmless content to automated scanners. This tactic, combined with its active status and low VirusTotal detection rate, underscores the importance of early detection systems like PhishDestroy's, which identify threats in the critical window before they are widely recognized by antivirus databases.