doc[.]pumpswap[.]biz

The domain doc.pumpswap.biz has been identified as engaging in brand impersonation, specifically targeting the financial services brand Revolut. This domain was designed to deceive users into believing they were interacting with the legitimate Revolut site, potentially leading to credential theft or other fraudulent activities. The page title "PUMPSWAP | Product Docs" suggests an attempt to mask its malicious intent under the guise of legitimate documentation.

Several technical indicators confirm the suspicious nature of this domain. According to VirusTotal, it has been flagged by 2 out of 95 security vendors, indicating a moderate level of detection. The domain was registered through NameCheap, Inc., and resolves to the IP address 172.64.147.209. It was created on April 28, 2025, which is unusual as it implies a future date, possibly indicating a typographical error or other registration anomaly. The domain has been blocked by PhishDestroy and appears on one security blocklist, further reinforcing its malicious classification.

Currently, doc.pumpswap.biz is offline, reducing its immediate threat. However, the presence of technologies such as Cloudflare and Google Cloud may have been used to enhance its appearance of legitimacy. Continued monitoring is recommended to ensure it does not resurface. Users should remain vigilant and verify URLs, especially those requesting sensitive information. Security teams should update blocklists and educate users on recognizing such threats to mitigate potential risks effectively.