rubin[.]trade

Analysis of the domain rubin.trade, conducted on August 05, 2026, indicates active phishing infrastructure targeting cryptocurrency users. The domain remains operational and is hosted on Yandex Cloud nameservers (ns1.yandexcloud.net, ns2.yandexcloud.net), resolving to the IP address 178.154.219.104. Security vendors have flagged this domain, with 5 out of 91 detection engines on VirusTotal identifying it as malicious.

It appears on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, suggesting a focus on cryptocurrency-related threats. The domain's infrastructure and detection patterns align with known phishing campaigns, though the exact content or targeted brand has not been confirmed through page analysis. The use of Yandex Cloud hosting is consistent with other observed phishing operations, which often leverage cloud providers to evade takedowns.

Defenders should treat this domain as high-risk and prioritize blocking it at the DNS or network level. Organizations using cryptocurrency wallets or platforms should ensure users are aware of this threat, particularly if MetaMask or similar tools are in use, as these vendors have already implemented protections. Further investigation into the domain's HTTP responses, SSL certificates, and any associated subdomains may provide additional context, but current evidence supports immediate mitigation.