simplerug[.]xyz

Analysis of simplerug.xyz shows it was registered on 22 October 2025 through NameSilo, LLC and is served by Cloudflare nameservers dana.ns.cloudflare.com and ethan.ns.cloudflare.com. The domain resolves to IP address 188.114.96.3, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. No TLS certificate is presented, so the site is only reachable via HTTP. An HTTP request returns a 522 Connection timed out page title “simplerug.xyz | 522: Connection timed out”, indicating the origin server is unreachable at the time of testing and the domain is currently offline.

Threat intelligence associates the domain with an Airdrop Scam phishing kit, a pattern frequently used to lure victims into submitting cryptocurrency wallet credentials. Reputation services have assigned a Gridinsoft trust score of 0 out of 100, and the domain appears on one known security blocklist. Six of ninety‑five VirusTotal scanners have flagged the domain as malicious, providing independent confirmation of its abusive intent. The domain is also listed by the PhishDestroy blocklist, reinforcing its classification as a phishing infrastructure.

Because the site is hosted behind Cloudflare, attribution of the underlying web server is obscured, but the use of Cloudflare’s DNS and edge network is consistent with many short‑lived malicious domains. At present, no Safe Browsing or OTX entries are available, and the content of the page has not been captured beyond the timeout message, leaving the exact phishing landing page unknown. Defenders should proactively block simplerug.xyz at DNS resolvers and perimeter firewalls, add the IP address 188.114.96.3 to threat‑intel feeds, and monitor for future redeployments that reuse the same registrar or nameserver pattern.