ruji[.]trade

The domain ruji.trade is identified as a brand-impersonation threat specifically targeting ChatGPT users. Analysis indicates this infrastructure was designed to harvest login credentials and personal data under the guise of the legitimate service. Currently, the domain is offline, but prior activity suggests a deliberate attempt to deceive users through fraudulent authentication portals. Infrastructure analysis reveals ruji.trade was flagged by 5 of 95 security vendors on VirusTotal, indicating moderate detection coverage. The domain was registered through Dynadot LLC on November 14, 2025, and resolved to the IP address 172.67.187.34. It appears on 2 security blocklists, including ScamSniffer and PhishDestroy, and holds a Gridinsoft trust score of 0/100. Technical indicators include the use of Google Web Server, HSTS enforcement, and HTTP/3 protocol, alongside a Let's Encrypt SSL certificate. The page title 'Rujira' further deviates from the expected branding, confirming its fraudulent nature. At present, ruji.trade is inaccessible, likely due to takedown or suspension. However, the domain's infrastructure and registration details remain active, posing a residual risk. Organizations and users are advised to block the domain and its associated IP at the network level. Security teams should monitor for any re-emergence of the domain or similar variations under the same registrar. End-users should verify the authenticity of ChatGPT-related domains by cross-referencing official sources and checking for valid SSL certificates issued to OpenAI.