pumpairdrop-claim[.]pages[.]dev

Analysis as of July 22, 2026 shows that pumpairdrop-claim.pages.dev is an offline site that responded with HTTP 403 and is listed on two public blocklists. The domain was registered on February 21, 2026 through Cloudflare, Inc., and resolves to the Cloudflare IP address 172.66.45.40 located in the United States under ASN 13335. SSL inspection reveals a Google Trust Services certificate (WE1), indicating the site employed a legitimate TLS certificate despite its malicious purpose. VirusTotal records indicate that five of ninety‑five scanning engines flagged the domain, reinforcing the suspicion of malicious activity.

The page title returned by the server is "Pump.fun - Airdrop," and the observed technology stack includes UIKit, HSTS, Google Analytics, Cloudflare services, and HTTP/3, all of which are common in phishing deployments. Intelligence sources identify the site as using an "Airdrop Scam" kit and classify the campaign as wallet/seed phishing that impersonates Discord, targeting users with promises of a token airdrop. Reputation services assign extremely low trust scores (Gridinsoft 0/100, Scamadviser 1/100). The domain has been actively blocked by PhishDestroy and ScamSniffer.

While the site is currently inaccessible, its infrastructure—Cloudflare hosting, legitimate TLS, and the use of a known phishing kit—suggests a deliberate attempt to harvest Discord credentials or cryptocurrency seeds. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the associated IP and nameservers (lana.ns.cloudflare.com, ethan.ns.cloudflare.com), and educate users that any unsolicited Discord‑related airdrop request from this URL is malicious. Ongoing observation of the IP range and related Cloudflare‑hosted domains is recommended to detect potential re‑hosting of the kit.