evmrabby[.]site

Analysis of the domain evmrabby.site indicates confirmed phishing infrastructure targeting users of the Avalanche cryptocurrency platform. The domain was registered on November 4, 2025, through HOSTINGER operations, UAB, and resolved to the IP address 84.32.84.100, hosted on AS47583 (Hostinger International Limited) in Lithuania. No SSL certificate was detected, increasing the risk of unencrypted data interception. The domain's page title, 'Rabby Live Prices,' suggests an attempt to mimic legitimate cryptocurrency price tracking or wallet services, aligning with the reported scam type of a crypto scam.

Security vendor assessments further support malicious classification: Gridinsoft assigned a trust score of 0/100, and Google Safe Browsing flagged the domain for social engineering. The domain appears on one security blocklist and was flagged by 14 of 93 vendors on VirusTotal, though the absence of additional context limits deeper attribution. Nameservers ns1.dns-parking.com and ns2.dns-parking.com are consistent with low-cost or disposable hosting setups often used in phishing campaigns. As of July 23, 2026, the domain has been taken offline, though defenders should monitor for reactivation or migration to new infrastructure.

The combination of brand impersonation, cryptocurrency-themed content, and low-reputation hosting infrastructure confirms evmrabby.site as a high-risk phishing domain. Organizations should block the domain and associated IP at the network level, and users should be alerted to avoid interaction with any future iterations of this campaign. No evidence of a specific phishing kit or additional attack vectors was observed in the available data.