rluxgames[.]click

PhishDestroy identifies rluxgames.click as an active crypto drainer scam site falsely posing as a gaming platform. The domain leverages deceptive branding to trick users into connecting crypto wallets, leading to fund theft. This is not a generic phishing attempt but a targeted credential theft campaign designed to drain cryptocurrency assets. Current status of the domain is confirmed malicious and actively serving malicious content.

This domain was flagged by 4 of 95 VirusTotal security vendors as malicious at the time of detection. It resolves to IP address 91.218.49.169 and was registered through Dynadot, LLC on December 21, 2025, making it a recently established threat. The infrastructure uses a Let's Encrypt SSL certificate, which may enhance its credibility to unsuspecting users. With minimal detection coverage and freshly registered infrastructure, this domain represents an elevated risk to crypto investors and gamers alike.

Due to the confirmed crypto drainer functionality and low detection coverage by security vendors, PhishDestroy recommends immediate action to block rluxgames.click at the network perimeter. Organizations should add this domain and its IP address (91.218.49.169) to firewall blocklists and DNS sinkholes. Users encountering this domain should report it to their cryptocurrency wallet providers and avoid any interaction with the site or related links. Additionally, security teams should monitor for connections to this IP range as threat actors often shift infrastructure. This threat should be treated with high priority due to the irreversible nature of cryptocurrency losses once credentials are compromised.