rubix-scanner[.]vercel[.]app

rubix-scanner.vercel.app is flagged as a high-risk generic phishing domain. The domain appears to impersonate a legitimate security scanner service, potentially aiming to deceive users into divulging sensitive information or installing malicious software.

Analysis indicates that this domain has been flagged by 4 out of 95 security vendors on VirusTotal, suggesting a moderate level of detection. The domain is registered through Vercel and resolves to the IP address 216.198.79.67, which is located in the United States and associated with CYPRESS COMMUNICATIONS, LLC. The domain was created on April 21, 2026, and its SSL certificate is issued by Google Trust Services / WR1. It also appears on 1 security blocklist, specifically PhishDestroy, which further corroborates its malicious intent.

Currently, the domain remains active, posing a significant threat to unsuspecting users. Immediate response actions include adding the domain to security blocklists, educating users about the risks of interacting with unknown security scanner services, and enhancing monitoring for related malicious activities. Despite these measures, the risk remains high due to the potential for rapid adaptation and evasion techniques employed by the threat actors.