ruthsplacecafe[.]com

Analysis of ruthsplacecafe.com, observed on July 28 2026, shows the domain is actively serving malicious content. The domain resolves to the IPv4 address 3.33.130.190 and returns HTTP 200 responses, indicating a live web server. Registration information lists GoDaddy.com, LLC as the registrar, with authoritative name servers ns15.domaincontrol.com and ns16.domaincontrol.com. The domain appears on one security blocklist and is currently listed by PhishDestroy, confirming that at least one trusted sinkhole has flagged it.

VirusTotal scans have identified the domain as malicious in three out of ninety‑one AV engines, providing additional corroboration of its threat profile. The limited intelligence does not include a page title, SSL certificate details, or explicit branding, so the exact content served by the site remains unverified. However, the classification of “generic phishing” in the source data suggests the site is being used to harvest credentials or personal information. The presence of an active HTTP service, a known hosting IP, and multiple detections across independent platforms indicates a high risk to users who may inadvertently visit the domain.

Defenders should block ruthsplacecafe.com at network perimeter and add the associated IP address 3.33.130.190 to deny‑list rules. Monitoring of DNS queries for the domain and its name servers is recommended to detect potential lateral movement. Security teams should also update endpoint and web‑gateway filters with the current VirusTotal detection count and the PhishDestroy blocklist entry. Continued observation of the domain’s DNS records and any changes in detection scores will help refine the risk posture as the campaign evolves.