rugpull[.]xyz

The domain rugpull.xyz is currently active and identified as a crypto drainer phishing threat. This type of attack specifically targets cryptocurrency wallet credentials, tricking users into connecting their wallets to malicious smart contracts that drain funds. The domain remains operational, with no confirmed brand impersonation at this time, though its generic redirect behavior suggests broad targeting of crypto-related services. Analysis of rugpull.xyz reveals multiple technical indicators of malicious activity. The domain is flagged by 12 of 95 security vendors on VirusTotal, indicating widespread detection. It was registered on April 30, 2026, through Sav.com, LLC, and resolves to the IP address 172.237.145.27. Infrastructure analysis shows the use of Nginx and OpenResty web technologies, with a Let's Encrypt SSL certificate providing HTTPS encryption. The domain appears on one security blocklist and has a Gridinsoft trust score of 0/100, further confirming its malicious classification. The page title 'Redirecting...' suggests dynamic redirection to malicious endpoints, a common tactic in crypto drainer schemes. Current status indicates rugpull.xyz remains an elevated risk to users. Organizations and individuals are advised to block the domain and its associated IP address at the network level. End users should avoid interacting with any content from this domain, particularly prompts to connect cryptocurrency wallets. Security teams are recommended to monitor for connections to 172.237.145.27 in network logs and investigate any related activity. Given the domain's recent creation date and active malicious status, continuous monitoring for new variants or associated infrastructure is warranted.