app[.]rubic[.]lat

app.rubic.lat was observed hosting a fraudulent interface that mimics the Solana brand. The page title “Swap Crypto | Decentralized Crypto Exchange | Rubic Exchange” is displayed, and the site is classified as a wallet_connect_phish campaign. The domain was created on March 16, 2026 and is currently active, returning HTTP 200 for all requests. The domain resolves to the IP address 172.67.70.182, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. Both authoritative name servers are hosted by Cloudflare (june.ns.cloudflare.com and nikon.ns.cloudflare.com). The site leverages Cloudflare services, including Browser Insights and HTTP/3, and its front‑end uses Bootstrap. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single external blocklist. VirusTotal reports that 1 of 95 scanning engines flagged the domain as malicious. The fraudulent page attempts to deceive users by presenting itself as a Solana‑related exchange, a classic brand‑impersonation tactic. The wallet‑connect phishing vector is evident from the “wallet_connect_phish” classification, indicating that the site likely harvests wallet connection credentials when victims authorize transactions. PhishDestroy has already added the domain to its blocklist, confirming active abuse. While the current evidence confirms active malicious activity, the full scope of victim outreach (e.g., distribution channels, phishing emails) remains unknown. Defenders should block DNS resolution for app.rubic.lat, enforce network‑level filtering of its IP address, and monitor Cloudflare‑associated traffic for anomalous wallet‑connect requests. Security teams should also inspect logs for any successful wallet‑connect handshakes originating from internal clients. Continuous re‑assessment is advised, as the infrastructure can be shifted behind Cloudflare’s flexible edge network.