rubic-swap[.]click

Analysis of rubic-swap.click shows a newly registered domain created on June 08, 2026 through Dynadot, LLC. The domain resolves to the IPv4 address 130.12.180.128, indicating a single hosting endpoint for the observed activity. VirusTotal records indicate that five of ninety‑one security vendors have flagged the domain, providing an early indication of malicious intent. The domain is listed on three independent security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a phishing‑related resource.

The threat is currently marked as active with an elevated risk rating, suggesting that threat actors may be leveraging the domain in ongoing campaigns. No public page title, SSL certificate details, HTTP response codes, or content analysis are available at this time, leaving the exact landing page and impersonated brand indeterminate. Defenders should prioritize the immediate addition of rubic-swap.click to network and endpoint blocklists, enforce DNS‑level filtering, and monitor outbound connections to the associated IP address.

Continuous re‑scanning with multi‑vendor services is advised to capture any evolution in detection scores. Organizations using cryptocurrency swap services should be aware of potential credential harvesting attempts and educate users to verify URLs before entering sensitive information. Ongoing telemetry collection, including DNS query logs and proxy traffic, will help confirm the scope of abuse and support future attribution efforts.