extension-rabby[.]com

Analysis of extension-rabby.com indicates a brand impersonation phishing domain targeting Rabby, a cryptocurrency wallet service. The domain was registered on March 24, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and is currently offline as of the report date. Infrastructure analysis reveals the domain resolved to IP address 188.114.97.3, hosted by Cloudflare, Inc. in Canada, with nameservers ruth.ns.cloudflare.com and tanner.ns.cloudflare.com. The site was served via Cloudflare with HTTP/3 support and utilized Plesk with PHP, as detected through technology fingerprinting. The SSL certificate was issued under the common name 'Plesk,' a pattern often observed in automated or low-effort phishing setups.

The page title 'Rabby Wallet' directly matches the brand targeted, confirming the intent to deceive users into believing the site is the legitimate Rabby service. Detection by security vendors is limited but notable: four of 95 security engines on VirusTotal flagged the domain as malicious. Additionally, the domain appears on two security blocklists, including PhishDestroy and ScamSniffer, which specialize in phishing and scam detection. Gridinsoft assigned a trust score of 0/100, reinforcing the assessment of elevated risk.

While the domain is currently offline, defenders should treat any future resolution or DNS changes with caution. The combination of brand-specific page title, low trust scores, and blocklist presence provides concrete evidence of malicious intent. Organizations should ensure endpoint protection and email filtering systems are updated to block this domain and any associated infrastructure. Further monitoring of the registrar and hosting provider may reveal related malicious domains using similar patterns.