rugmedaddy[.]fun

PhishDestroy identifies the domain rugmedaddy.fun as an active cryptocurrency drainer scam site. The threat type is classified as a generic_phishing campaign with a high likelihood of targeting digital asset holders, particularly those engaged in Ethereum transactions. No specific brand or drainer kit variant has been confirmed at this stage, but the domain's recent creation and hosting infrastructure suggest a focus on fraudulent activity. This domain was flagged with a VirusTotal score of 1/95 detections, indicating it has evaded detection by security vendors at the time of analysis. Registered through Spaceship, Inc., the domain resolves to IP address 216.198.79.1 and utilizes a Let's Encrypt SSL certificate. The domain was created on February 22, 2026, and remains unlisted on Google Safe Browsing (GSB) and other major blocklists. These technical indicators highlight a newly established, low-profile infrastructure designed to avoid early detection. The campaign is currently active, with no confirmed takedown or mitigation measures in place. Users interacting with this domain risk exposure to cryptocurrency drainer scripts or credential harvesting. Immediate action is recommended: block the domain rugmedaddy.fun and associated IP 216.198.79.1 at the network level, scan endpoints for suspicious connections, and report the domain to threat intelligence platforms. Remaining risk is assessed as medium-high due to the domain's active status and lack of vendor detections. Proactive monitoring and user awareness are critical to prevent financial losses.