ruxbit[.]com

The domain ruxbit.com was registered on July 18, 2025 through NiceNIC International Group Co., Limited and resolves to the Cloudflare address 172.67.194.111, an IP located in the United States and announced as AS13335 Cloudflare, Inc. The authoritative nameservers are arya.ns.cloudflare.com and dexter.ns.cloudflare.com, both belonging to Cloudflare’s DNS service. The site presented the page title “Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | RuxBit,” indicating an attempt to position itself as a cryptocurrency exchange. The listed brand target is Ethereum, and the overall scam classification is a Crypto Scam, suggesting that the domain is being used to lure victims into fraudulent transactions involving Ethereum or other digital assets. Security telemetry shows that eight of ninety‑five VirusTotal scanners flagged the domain, and it appears on at least one external blocklist.

PhishDestroy has already taken the domain offline, and the current HTTP status is reported as taken offline with no active SSL certificate, meaning any remaining traffic would be unencrypted. Independent reputation scoring from Gridinsoft assigns a trust score of 1 out of 100, reinforcing the perception of a highly malicious infrastructure. While the domain is presently offline, the combination of a low trust score, multiple vendor detections, blocklist inclusion, and the explicit brand impersonation of Ethereum constitutes strong evidence of malicious intent.

Uncertainty remains regarding the specific payload or phishing pages that may have been hosted before takedown, as no visual or content analysis is available. Defenders should continue to block the IP address 172.67.194.111 and the domain ruxbit.com at network perimeter devices, update intrusion detection signatures to include the observed page title and nameserver pattern, and monitor for any re‑registration attempts that reuse the same registrar or similar naming conventions.