hlp-rabbywalet-x[.]pineapple[.]page

This domain, hlp-rabbywalet-x.pineapple.page, is flagged as an active brand impersonation threat targeting users of the Across protocol, a cross-chain bridging service. Analysis indicates the site presents itself as a Trezor Suite Wallet, as evidenced by the page title 'Trezor Suite Wallet – Control Your Crypto Safely,' despite the domain name containing no direct reference to Trezor or Across. The domain was registered on September 21, 2022, through Squarespace Domains II LLC and currently resolves to the IP address 216.150.1.1. It employs a Let's Encrypt SSL certificate, which provides encryption but does not validate the legitimacy of the site's operators. Infrastructure analysis reveals the use of Vercel hosting and React framework, technologies commonly used for both legitimate and malicious web applications. The presence of HSTS (HTTP Strict Transport Security) suggests an attempt to appear secure, though this header is not exclusive to trustworthy sites. The domain is detected by 17 out of 95 security vendors on VirusTotal, and it appears on at least one blocklist, specifically PhishDestroy. Gridinsoft assigns the domain a trust score of 0 out of 100, further indicating high-risk classification. What remains uncertain is the exact mechanism of compromise, as the site's content has not been directly analyzed. However, the combination of brand impersonation, cryptocurrency-related branding, and active blocklist presence strongly suggests an intent to deceive users into disclosing sensitive information or transferring assets. Defenders should treat this domain as malicious and prioritize blocking it at the network level. Organizations should also monitor for related domains using similar naming patterns, such as the inclusion of 'rabbywalet' or 'pineapple.page,' which may indicate additional infrastructure linked to the same threat actor. No assumptions should be made about the scale or success of the campaign beyond the observable data.