ruggpt[.]pro

Analysis of the domain ruggpt.pro, created on July 17 2026, shows a clear alignment with phishing activity despite a lack of detection by automated scanners. The domain is registered through PDR Ltd. d/b/a PublicDomainRegistry.com and is served by Cloudflare nameservers james.ns.cloudflare.com and magdalena.ns.cloudflare.com. DNS resolution points to the IP address 104.21.79.226, a Cloudflare edge node that is commonly leveraged to obscure the true hosting location of malicious actors. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service, indicating that at least one reputable anti‑phishing feed has identified it as malicious.

VirusTotal records reveal that the domain was examined by 95 security vendors; none of those vendors raised a detection at the time of scanning, but the absence of a flag does not constitute evidence of safety and should not be interpreted as a clearance. No public information on SSL certificate details, HTTP response codes, or page title is currently available, so the surface‑level characteristics of the site remain unverified. The limited intelligence suggests a newly registered domain used for a generic phishing campaign, likely exploiting the short window between registration and active abuse.

Defenders should immediately add ruggpt.pro to local blocklists, enforce DNS‑level filtering, and monitor outbound traffic for connections to the associated Cloudflare IP range. Continuous re‑scanning with sandbox and URL reputation services is advised, as the lack of current detections may change rapidly. Organizations should also consider implementing email authentication checks (DMARC, SPF, DKIM) to reduce the likelihood of successful phishing attempts that reference this domain.