rugsoli[.]com

PhishDestroy identifies rugsoli.com as a recently activated domain engaged in generic phishing operations suspected of harvesting user credentials. The domain mimics no specific brand at this time, suggesting opportunistic targeting rather than focused impersonation. No crypto drainer kit signatures have been detected during initial triage, but behavioral analysis remains ongoing to rule out evolving tactics.

Exact threat indicators confirm elevated risk exposure: the domain resolves to 104.21.0.95, carries a Let's Encrypt SSL certificate, and was registered on March 17, 2026 through Hello Internet Corp. VirusTotal currently shows 3/95 detections, indicating a fresh threat possibly still under adversary refinement. Google Safe Browsing (GSB) and major blocklists have not yet flagged rugsoli.com, leaving endpoints exposed to initial compromise attempts.

This domain remains active with 'under investigation' status. Immediate containment involves blocking traffic to rugsoli.com and 104.21.0.95 at DNS, firewall, and proxy layers. SOC teams should scan for anomalous login patterns or data exfiltration to external domains. While current risk is elevated due to zero detections, proactive blocking mitigates potential credential theft spread during the unfolding probe.