pumpfun-airdrop[.]pages[.]dev

The domain pumpfun-airdrop.pages.dev was registered on March 22, 2026 through Cloudflare, Inc. and resolves to the Cloudflare‑owned address 172.66.47.53, which is geolocated to Canada. The site presents the page title “Pump.fun – Airdrop”, directly referencing the legitimate brand Pump.fun, and is classified as a fake‑airdrop impersonation campaign. TLS is provided by Google Trust Services under the WE1 certificate, and the server advertises HSTS, Cloudflare and HTTP/3, indicating the use of Cloudflare’s edge network. An HTTP 403 response is returned when the site is accessed, and the domain is currently marked as taken offline.

VirusTotal records show that four of ninety‑four scanning engines have flagged the domain, and the domain appears on one external blocklist. PhishDestroy has already blocked the domain, and Gridinsoft assigns it a trust score of 0/100, confirming the malicious assessment. The phishing kit identified is the “Airdrop Scam” kit, consistent with the fake‑airdrop narrative. No additional infrastructure such as C2 servers or malware payloads has been observed.

Uncertainty remains around the exact content served before the 403 status, as the page has not been publicly retrieved. Defenders should continue to block the domain at network perimeter, monitor DNS queries for the domain and its associated IP, and add the indicator to internal blocklists. Given the low trust score and vendor detections, the domain should be treated as high‑confidence malicious and any traffic to it should be denied.