bitsramp[.]org

Analysis of bitsramp.org shows multiple indicators of a high‑risk brand‑impersonation campaign targeting Near. Google Safe Browsing has flagged the domain for social engineering, and VirusTotal reports that 11 of 95 security vendors have identified malicious behavior. The site resolves to IP 185.106.179.4, which belongs to AS932 XNNET LLC and is geolocated in Hong Kong. Scamadviser assigns a trust score of 46 / 100, reflecting a moderately suspicious reputation. The page title returned by the HTTP response is "Onchain," but no SSL certificate is present, meaning the site operates over plain HTTP only.

Registration data indicates the domain was created on 26 September 2025 through Dynadot LLC, using the authoritative nameservers ns1.dyna-ns.net and ns2.dyna-ns.net. The domain currently appears on two security blocklists—PhishDestroy and ScamSniffer—and has been listed on two broader blocklists, reinforcing the assessment of malicious intent. The domain’s status is marked as taken offline, but the offline state may be temporary; historical activity suggests the infrastructure was actively serving malicious content before removal. Defenders should treat bitsramp.org as a confirmed malicious actor and enforce immediate blocking at the DNS or proxy layer.

Network security devices should be updated to deny traffic to 185.106.179.4, and any existing outbound connections to that IP should be terminated. Continuous monitoring of the registrar (Dynadot) and the hosting ASN (AS932) is recommended to detect re‑registration or new domains pointing to the same infrastructure. Because the site was flagged by multiple vendors, threat‑intel sharing platforms should be updated with the domain, IP, and associated indicators of compromise. Organizations should also review logs for any recent requests to bitsramp.org or its IP address, especially from users who interact with Near services, to identify possible exposure.