rupeego[.]live

Analysis of rupeego.live indicates a newly registered internet resource that is currently active and associated with generic phishing activity. The domain was created on July 16, 2026 and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. It uses the authoritative name servers ns3.my-ndns.com and ns4.my-ndns.com, which are common to several short‑lived domains observed in phishing campaigns. DNS resolution points to the IPv4 address 185.9.17.220; no additional IP aliases or CDN front‑ends have been identified. The domain appears on a single public blocklist and is explicitly blocked by the PhishDestroy service, confirming that at least one security vendor has flagged it as malicious. VirusTotal has processed the domain with 95 scanning engines, none of which have raised a detection at the time of analysis, but the absence of detections does not constitute evidence of benign intent. No SSL/TLS certificate details, HTTP response codes, page titles, or content snapshots are presently available, limiting the ability to corroborate the phishing payload or target brand. Given the recent registration date, the presence on a blocklist, and the association with a known phishing‑blocking service, defenders should treat rupeego.live as hostile. Recommended mitigations include adding the domain and its resolving IP address to network deny lists, monitoring the name servers for rapid changes, and employing sink‑hole or redirect controls for outbound connections. Continuous re‑evaluation is advised as additional telemetry, such as content analysis or further vendor detections, becomes available.