pumpswap[.]rest

Analysis of the domain pumpswap.rest indicates active brand impersonation targeting Solana cryptocurrency users. Registered on March 2, 2026, through Global Domain Group LLC, the domain resolves to 172.67.164.145 (AS13335, Cloudflare, Inc., US) and is served by Cloudflare nameservers linda.ns.cloudflare.com and sullivan.ns.cloudflare.com. The SSL certificate is issued by Let's Encrypt (serial E7). The page title, PUMP | Solana Meme Token, explicitly references the Solana blockchain and a meme token named PUMP, suggesting an attempt to deceive users into engaging with fraudulent crypto offerings. Infrastructure reveals the use of Node.js, Vue.js, Nuxt.js, and Cloudflare Browser Insights, with HTTP/3 support. The domain is flagged by three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. While only 2 of 93 security vendors on VirusTotal currently detect this domain, its presence on multiple blocklists and active blocking by crypto-specific security tools indicate a high-risk classification. The domain remains operational as of July 12, 2026, with an HTTP 200 status. Defenders should treat this domain as an active crypto scam and prioritize blocking or monitoring connections to 172.67.164.145 and the domain itself. Further analysis of the site's functionality is recommended to determine if it operates as a drainer, fake token sale, or other fraudulent scheme. Given the Cloudflare proxy, additional network-level indicators may be required for effective mitigation.