rubic-exchange[.]app

PhishDestroy identifies rubic-exchange.app as an active cryptocurrency exchange scam under investigation for credential harvesting and fund theft. The domain mimics a legitimate trading platform to deceive users into connecting wallets or entering login details. No specific drainer kit signature has been extracted yet, but the site’s fraudulent branding and recent creation strongly suggest a generic cryptocurrency drainer deployment targeting multiple victims. rubic-exchange.app exhibits clear malicious indicators: VirusTotal detection rate remains at 2/95, indicating no antivirus coverage as of current scans. The domain was registered on April 24, 2026 through Dynadot LLC, resolving to IP 176.125.242.151. A Let’s Encrypt SSL certificate is in use, likely to enhance trust perception. Google Safe Browsing (GSB) status is currently unflagged, and no public blocklists have been observed covering this domain. These technical traits—especially the zero detection score and fresh domain age—signal a recently launched campaign with low detection visibility. As of this assessment, rubic-exchange.app remains active with no takedown actions or blocklist additions. Immediate user actions include avoiding the site, revoking any connected wallet permissions, and reporting the domain to security teams and platforms like Google Safe Browsing. Remaining risk is assessed as high due to the active status, zero detection coverage, and deployment of a likely generic drainer targeting crypto users. Continuous monitoring is required until automated detection improves and infrastructure is disrupted.