rugsniffer[.]xyz

Analysis indicates that www.rugsniffer.xyz was registered on 24 October 2025 through Hostinger Operations UAB and points to the Amazon Web Services address 64.29.17.1, ASN 16509 located in the United States. The domain resolves to a Vercel DNS configuration (ns1.vercel-dns.com, ns2.vercel-dns.com) but does not present an SSL certificate, delivering content over plain HTTP. The page title observed during capture reads “Rug Sniffer – Stop Getting Rugged | Scan Solana Tokens Before You Buy,” and the site claims to impersonate the Curve brand while delivering a wallet/seed phishing kit. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, and the domain has been listed on a single security blocklist.

VirusTotal reports three detections out of ninety‑five scanners, confirming malicious classification by multiple vendors. PhishDestroy has taken the site offline, and the current status is reported as offline. Uncertainty remains regarding the full payload delivered to victims, as no sample of the phishing page or the exact credential‑harvesting mechanism has been publicly released. The lack of an SSL certificate limits the ability to capture TLS fingerprint data, and the brief blocklist presence suggests limited exposure at the time of takedown.

Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the same host‑header or IP address, and add the observed IP 64.29.17.1 to network‑level deny lists. Email security gateways should be updated to flag messages referencing “Rug Sniffer” or containing the Curve brand spoofing language. Incident response teams should collect any logs referencing this domain for forensic correlation, and threat‑intel feeds should be enriched with the registrar, creation date, and the three VirusTotal detections to improve early warning capabilities.