bitcoinboost[.]shop

This investigation documents the malicious infrastructure associated with bitcoinboost.shop, a domain registered through the Russian registrar REGRU‑RU on 21 February 2026. The domain is configured with the authoritative nameservers ns1.reg.ru and ns2.reg.ru, and its DNS resolution points to the IPv4 address 95.83.172.14. The IP belongs to Autonomous System AS15774, identified as Limited Liability Company TTK‑Svyaz, and is geolocated in the Russian Federation. No TLS certificate is present on the host, indicating that the site served only HTTP content.

The sole visible page title retrieved during scanning is “BITCOIN BOOST SHOP”, which directly references the brand target “Bitcoin”. The site is classified as a crypto‑related brand‑impersonation scam, attempting to exploit the Bitcoin brand for fraudulent gain. VirusTotal analysis shows that one out of ninety‑three security vendors flagged the domain, confirming at least a minimal level of malicious detection. Independent security feeds have added the domain to a blocklist, and the anti‑phishing service PhishDestroy records the domain as taken offline.

The domain currently appears on a single security blocklist, reflecting limited but existing exposure in threat‑intelligence platforms. Given the observed indicators, defenders should add bitcoinboost.shop and its resolved IP address 95.83.172.14 to network‑level deny lists and URL filtering policies. Monitoring of the registrar REGRU‑RU and the associated nameservers for further domains that resolve to the same IP or ASN is recommended, as threat actors often reuse infrastructure. Although the site is presently offline, the registration date and infrastructure suggest the possibility of rapid re‑deployment, so continuous vigilance is advised.