ruxavild-it[.]net

The domain ruxavild-it.net was registered on February 21, 2026 and is presently taken offline. Infrastructure analysis shows the domain resolves to the IP address 188.114.96.3, which belongs to Cloudflare, Inc. (ASN 13335) and is geolocated in the United States. The authoritative name servers are hal.ns.cloudflare.com and samara.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. No SSL/TLS certificate is presented for the site, indicating that HTTPS was not enforced at the time of observation. The page title returned by the server, "Ruxavild - Piattaforma Ufficiale Italia | Trading IA 2026," contains no direct reference to the impersonated brand, but the intelligence feed tags the campaign as a brand‑impersonation targeting the brand "base".

The domain appears on three public security blocklists and has been flagged by multiple anti‑phishing services, including PhishDestroy, MetaMask, and SEAL. VirusTotal scans report that 15 of 93 security vendors labeled the domain as malicious, reinforcing the suspicion of illicit activity. The registrar listed is PDR Ltd. d/b/a PublicDomainRegistry.com, a service often used for rapid domain provisioning. Gridinsoft assigns a trust score of 0 / 100, the lowest possible rating, further indicating a high likelihood of abuse.

Because the site is offline, direct content analysis is unavailable, and the exact phishing payload or credential‑capture mechanisms cannot be confirmed. Defenders should continue to block the domain at perimeter firewalls, DNS filtering solutions, and endpoint protection suites. Monitoring of the associated IP address and Cloudflare name servers for any re‑activation is recommended, as threat actors frequently recycle infrastructure. Incident response teams should also correlate any observed attempts to contact base‑related services with this indicator to identify potential compromised accounts or ongoing credential‑stealing campaigns.