rucds[.]com

PhishDestroy identifies rucds.com as a live generic phishing domain engineered for credential theft, not just generic phishing. The domain does not match any single brand impersonation or deploy a known crypto drainer kit at this time; instead it harvests user credentials through a spoofed login portal. Registrant behavior and page content suggest opportunistic harvesting intended for wallet exfiltration or exchange account takeover. Further analysis of the landing page confirms a credential capture form mimicking a prominent crypto service login without direct ties to a specific drainer service pack. The threat remains under investigation for expansion into drainer toolkits or targeted brand impersonation. rucds.com resolves to IP 188.114.97.3 and was registered on December 18, 2025 through Porkbun LLC. The domain holds a Google Trust Services SSL certificate and currently shows 0 detections on VirusTotal out of 95 engines. As of the last scan, this domain has not been listed on any public blocklists maintained by Google Safe Browsing or commercial threat feeds. The combination of a fresh domain, zero detections, and use of a branded SSL certificate suggests a recently activated attack chain. Current indicators point to low prior reputation across defenses, increasing the risk of successful user compromise. The campaign is actively live and has not been sinkholed or blocked by major browsers or security platforms. At present, the risk level is classified as under investigation due to limited telemetry and no confirmed drainer payload delivery. Immediate user guidance includes avoiding any login attempts on rucds.com, verifying wallet access only through official URLs, enabling 2FA, and reporting the domain to security teams or browsers via Google Safe Browsing submission. Monitoring for expansion into drainer deployment or targeting of specific exchanges is recommended. Remaining risk remains moderate due to fresh infrastructure and low detection coverage, warranting continued scrutiny and proactive blocking where feasible.