rabby-io[.]wasmer[.]app

rabby-io.wasmer.app impersonates the Rabby Wallet brand, aiming to deceive users into believing they are interacting with a legitimate DeFi wallet service. The domain was flagged as malicious by 6 out of 94 vendors on VirusTotal and is listed on one public blocklist, specifically by PhishDestroy. Despite the site's current offline status, it previously posed a significant threat to users seeking secure multi-chain DeFi wallet services.

The domain was registered through Squarespace Domains II LLC and hosted on an IP address in France, under the organization ONLINE. It used a Let's Encrypt SSL certificate, which is common among phishing sites due to its ease of access and cost-free nature. The domain was created and detected by PhishDestroy on April 16, 2026, indicating a swift identification of the threat.

The platform risk score for this domain was calculated at 63 out of 100, reflecting a moderate level of risk. This score, combined with the impersonation of a well-known brand like Rabby, underscores the potential for significant harm. The quick takedown of the site limits its impact, but it serves as a reminder of the persistent threats in the digital landscape. Phishing domains like rabby-io.wasmer.app exploit the gap between domain registration and detection by antivirus databases, highlighting the importance of early threat identification.