filerubyfolder[.]sbs

Analysis of filerubyfolder.sbs shows an infrastructure typical of a newly created phishing operation. The domain was registered on May 22, 2026 through Dynadot Inc and is currently hosted on the IP address 188.114.97.10, which is served by Cloudflare as indicated by the authoritative nameservers chuck.ns.cloudflare.com and kinsley.ns.cloudflare.com. VirusTotal scans have recorded 16 detections out of 91 security vendors, confirming that multiple antivirus and URL‑filtering products flag the domain as malicious.

The domain appears on at least one public security blocklist and is actively blocked by the PhishDestroy service, demonstrating that community‑driven defences have already identified it as a threat. Its status remains active, meaning the site is still reachable and may continue to deliver phishing payloads. The limited public intelligence does not include a page title, SSL certificate details, HTTP response codes, or explicit brand impersonation, so the exact content and targeted victim profile remain uncertain.

Defenders should add 188.114.97.10 to network‑level deny lists, enforce DNS filtering for filerubyfolder.sbs, and ensure that endpoint protection solutions are updated to include the 16 vendor detections reported by VirusTotal. Continuous monitoring of Cloudflare‑associated IP ranges and periodic re‑scans of the domain are recommended to detect any changes in payload or hosting. Organizations with open email gateways should treat any communications referencing filerubyfolder.sbs as suspicious and block them until further verification can be performed.