v2-rubic-eth[.]click

This domain, v2-rubic-eth.click, was registered on 11 June 2026 through Dynadot, LLC. The authoritative nameservers are ns1.dyna-ns.net and ns2.dyna-ns.net, and the domain resolves to the IPv4 address 130.12.180.128. VirusTotal has recorded six positive detections out of ninety‑one scanners, indicating that multiple security engines consider the domain malicious. Independent blocklist monitoring shows the domain listed on three separate security blocklists, and it is explicitly blocked by the PhishDestroy, MetaMask, and SEAL protection services. The combination of registrar information, DNS configuration, and the observed detection counts aligns with the classification of a generic phishing campaign.

No additional metadata such as SSL certificate details, HTTP response codes, or page title information is presently available, leaving the full surface‑level behavior of the site unverified. Analysts should treat the domain as hostile and block any network traffic to the resolved IP address. Endpoint security solutions should add the domain to their deny lists, and web filtering products should continue to enforce the existing blocklist entries.

Monitoring of the hosting provider’s IP range for further malicious activity is recommended, as is periodic re‑scanning of the domain to capture any changes in detection status. Defenders are advised to educate users about the risk of unsolicited communications that reference the domain, especially in contexts involving cryptocurrency transactions, given the “rubic‑eth” naming pattern which may be used to lure victims. Until further forensic evidence becomes available, the domain remains an active threat with an elevated risk rating.