rubic[.]fun

PhishDestroy identifies rubic.fun as a live crypto drainer mimicking the Rubic DeFi bridge interface to siphon wallet funds. The domain mirrors legitimate branding and navigation flows to trick users into signing malicious transactions, leveraging JavaScript-based drainer kits commonly seen in 2024-2025 campaigns targeting Ethereum, BSC, and Tron wallets. This strain is known to parse wallet permissions and execute silent token transfers or NFT approvals without user awareness once a victim connects their wallet. Security analysts have observed similar drainers using obfuscated payloads hosted on Cloudflare or BunnyCDN, with recent samples showing rapid domain rotation to avoid takedowns.

Technical indicators for rubic.fun reveal a high-risk profile: the domain registered on November 14, 2025, through TUCOWS.COM, CO., resolves to IP 188.114.96.3 on ASN 13335 (Cloudflare), and carries a Google Trust Services SSL certificate. VirusTotal currently shows 0 detections out of 95 engines, with 1 security blocklist entry via ScamSniffer. Despite clean VT scoring, the absence of detections does not correlate with safety, as novel drainer variants often evade signature-based detection. The domain’s recent creation and immediate live status (active), combined with the presence of a legitimate-looking SSL certificate, suggest a well-prepared operation aimed at exploiting holiday traffic or new user onboarding to DeFi platforms.

As of the latest analysis, rubic.fun remains active and unblocked by major browsers or endpoint protections. PhishDestroy categorizes the threat as high-risk pending further evidence, with the drainer likely operational and collecting user wallet signatures. Immediate actions include blacklisting the domain at the network level, adding the IP to firewall rules, and flagging the SSL certificate for review. Users are advised to manually verify URLs via official Rubic channels, use browser extensions like WalletGuard or Rabby for transaction inspection, and never approve suspicious contract interactions. While the domain’s novelty limits historical intelligence, the combination of branding impersonation, active status, and cryptocurrency targeting elevates the risk to ‘under_investigation’ with a trajectory toward confirmed malicious classification.