rugbot[.]ai

PhishDestroy has opened an active investigation into rugbot.ai, a recently registered domain that mimics a legitimate AI assistant service to harvest user credentials and payment details. Initial scans show 0 detections out of 95 engines on VirusTotal, indicating it remains under the radar while actively phishing visitors. The domain was created on February 03, 2026, and is registered through GoDaddy.com, LLC, resolving to IP address 63.176.8.218 with a valid Let’s Encrypt SSL certificate—tactics often used to appear trustworthy while delivering malicious payloads. This site poses a concrete phishing threat by impersonating a helpful AI tool, luring users with promises of automated assistance, productivity hacks, or exclusive content—only to steal login credentials, payment data, or install malware. The absence of detections on VirusTotal (0/95) underscores its stealthy deployment, while the recent creation date and trusted hosting setup (GoDaddy + Let’s Encrypt) are classic red flags used to bypass initial scrutiny. Attackers frequently weaponize new domains with clean reputations to target both individuals and enterprises, exploiting the cognitive bias that associates “fresh” sites with “safe” sites. If you’ve visited rugbot.ai or entered any information, immediately change passwords for reused accounts, revoke saved payment methods if prompted, and run a full antivirus scan. Do not re-enter credentials or data on this domain. Report the site to your browser’s safe-browsing tool and consider blocking the IP 63.176.8.218. Stay vigilant: newly registered domains with low detection rates often signal emerging phishing campaigns targeting unwary users.