ruogux[.]com

PhishDestroy identifies ruogux.com as an active crypto drainer phishing domain using a spoofed brand identity. This domain was created on March 17, 2026, lacks legitimate registration details, and resolves to IP 104.21.45.249. Security tools have confirmed its malicious intent, redirecting users to fake wallet-login interfaces designed to steal private keys and drain crypto assets under the guise of a legitimate service. This domain shows a VirusTotal detection score of 1/95 security vendors, indicating low but present threat visibility. It is registered through GMO Internet, Inc., and secured with a Let's Encrypt SSL certificate—commonly abused to appear legitimate. With a creation date just days in the future from the current date, this domain exhibits classic time-based domain generation tactics often used to evade blocklists. It has not yet been widely blocked, making it a fresh and high-risk threat vector for unsuspecting users. ruogux.com remains active and is actively distributing crypto drainer kits to steal wallet credentials. Users entering seed phrases or private keys on this site will lose all crypto assets irrecoverably. PhishDestroy has flagged this domain with elevated risk and advises immediate blocking. The domain is monitored continuously; however, due to its recent activation and low VT visibility, users must verify all domains—especially new ones—before interaction. The current status is active with high exploitation potential.