rabbywallet-evm[.]firebaseapp[.]com

rabbywallet-evm.firebaseapp.com is actively impersonating the Rabby brand to conduct phishing attacks. The domain is flagged as malicious by 3 out of 91 vendors on VirusTotal, indicating a growing recognition of its threat potential. It is listed on public blocklists from PhishDestroy, MetaMask, and SEAL, highlighting its risk to users of the Rabby wallet.

The domain operates under Google's Firebase platform, which can lend an appearance of legitimacy. This tactic is often employed by threat actors to deceive users into trusting the site. The domain's creation date in 2026 suggests an error or manipulation, as it is currently active and engaging in phishing activities.

Phishing domains like rabbywallet-evm.firebaseapp.com exploit users by mimicking trusted brands, aiming to steal sensitive information such as login credentials. The presence of this domain on multiple blocklists underscores the importance of awareness and caution among Rabby users. Despite being flagged by several security vendors, the domain remains a threat, emphasizing the need for continuous monitoring and proactive security measures.