rugpullrun[.]app

Analysis of rugpullrun.app indicates a high-risk phishing domain actively targeting users with a crypto-related scam, as suggested by its page title 'Rug Pull Run.' The domain was registered on March 24, 2026, and remains operational despite being flagged by multiple threat intelligence sources. Infrastructure analysis reveals the use of Cloudflare for hosting and domain registration, alongside HTTP/3 and a Google Trust Services SSL certificate, which are common in both legitimate and malicious sites but often leveraged by threat actors to evade detection. The domain resolves to the IP address 216.24.57.251 and has been included in 17 threat intelligence pulses on AlienVault OTX, as well as two security blocklists. Six of 95 security vendors on VirusTotal have flagged this domain, though the specific nature of the detections remains unverified. The Gridinsoft trust score of 0/100 further corroborates its malicious classification. While the exact mechanics of the scam are not yet analysed, the combination of a suggestive page title, recent registration, and widespread blocking by security platforms strongly indicates an active phishing operation designed to deceive users in the cryptocurrency space. Defenders should treat this domain as hostile and implement blocking measures at the DNS or network level. Given its continued activity, monitoring for related infrastructure or newly registered lookalike domains is recommended. No legitimate use case has been identified for this domain, and its removal from allowlists is advised.