bitpump[.]ru

The domain bitpump.ru is currently active and has been identified as a brand‑impersonation campaign targeting Google. The site presents a Russian‑language page title “Хайп мониторинг и блог инвестиционных проектов”, which does not directly reference Google, indicating that the landing page content has not been publicly disclosed. The campaign is classified as a tech‑support scam, and its risk level is rated high. Infrastructure analysis shows the domain resolves to IP address 172.67.223.153, which belongs to the Cloudflare network (AS13335). The host is served by Nginx behind a Cloudflare reverse proxy, uses the jsDelivr CDN for static assets, and enforces HTTP Strict Transport Security. TLS is provided by a Let's Encrypt certificate (R12). Nameservers are ivy.ns.cloudflare.com and terry.ns.cloudflare.com. Registration occurred on 7 August 2017 through the REGRU‑RU registrar. Reputation signals are uniformly negative: Scamadviser assigns a trust score of 1 / 100, Gridinsoft rates it 0 / 100, and the domain appears on the PhishDestroy blocklist. VirusTotal analysis flagged the domain by one of ninety‑five security vendors. These indicators, combined with the high‑risk rating, suggest active malicious use despite the relatively low detection count. Defenders should treat bitpump.ru as hostile. Immediate actions include adding the domain and its resolving IP to network blocklists, configuring DNS filters to reject queries, and monitoring outbound traffic for connections to 172.67.223.153. Threat‑intel feeds should be updated to reflect the brand‑impersonation tag for Google, and security teams should watch for related phishing kits that leverage the same infrastructure.