runelings[.]xyz

The domain runelings.xyz was a generic phishing site designed to deceive users into disclosing sensitive information without impersonating a specific brand or deploying a known drainer kit. As of the latest verification, runelings.xyz has been taken offline, reducing immediate risk to visitors. However, its prior activity and detection by security vendors confirm it was actively used for phishing scams.

Technical indicators show that runelings.xyz was flagged by 2 of 95 VirusTotal security vendors, including Gridinsoft and Trustwave, while appearing on 1 security blocklist (PhishDestroy). The domain was registered through OwnRegistrar, Inc. on 2025-09-05 and resolved to the IP address 104.21.96.1, hosted on Cloudflare's network (AS13335). No SSL certificate was available, and the observed page title was 'Nur einen Moment…'. Gridinsoft assigned it a trust score of 0/100, further indicating malicious intent.

Users who may have interacted with runelings.xyz should immediately change any credentials entered on the site, enable two-factor authentication (2FA) on affected accounts, and monitor for unauthorized access or fraudulent transactions. Report the domain to platforms like Google Safe Browsing, PhishTank, or local cybersecurity authorities to aid in broader mitigation efforts. If financial or cryptocurrency accounts were exposed, consider revoking token approvals and transferring funds to a new, secure wallet.