I had to search for "gimp.org" to get the ad to be the first result; just searching "gimp" doesn't return the ad. The scam ad says "gimp.org" but if you follow

I had to search for "gimp.org" to get the ad to be the first result; just searching "gimp" doesn't return the ad. The scam ad says "gimp.org" but if you follow it, the landing page is hosted at gimp.monster. It's a clone of the proper gimp.org with a the download instead pointing to who-knows-what .exe on Dropbox. WHOIS gimp.monster has WHOIS-guard, but the Icelandic "privacy" address turns up a bunch of Reddit links about scam sites. Namecheap is the common thread, but that's hardly a lead.