vouchtiketpumpfun[.]netlify[.]app

The domain vouchtiketpumpfun.netlify.app was observed serving a page titled "Pump.fun - Airdrop" and is classified as a fake airdrop campaign targeting users of the Pump.fun platform. Infrastructure analysis shows the domain resolves to IP 63.176.8.218, which is hosted in Germany and belongs to AS16509 (Amazon.com, Inc.). The site was delivered via Netlify, indicated by the Netlify technology fingerprint and the registration pathway recorded as Netlify. An HSTS header is present, and the TLS certificate is issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1, confirming a valid SSL chain.

HTTP probing returned a 404 status, and the domain is currently taken offline, with the status marked as "offline" in the intelligence feed. The domain appears on one external security blocklist and is specifically listed as blocked by PhishDestroy. VirusTotal scanned the site with 95 antivirus engines and reported no detections; however, the lack of detections does not imply the domain is safe. The phishing kit identified is an "Airdrop Scam" kit, consistent with the page title and the impersonated brand Pump.fun.

Nameserver information is unavailable (NS_NOT_FOUND). While the site is no longer reachable, defenders should continue to block the domain and its associated IP address at network perimeters, update detection rules to flag any future re‑hosting of the same content, and monitor for re‑use of the Netlify hosting account. Further analysis is needed to confirm whether additional sub‑domains or similar Netlify deployments are being leveraged for the same campaign, as the current evidence is limited to this single observed instance.