rabbywallet[.]firebaseapp[.]com

Analysis of the domain rabbywallet.firebaseapp.com indicates active brand impersonation targeting Rabby, a cryptocurrency wallet service. The domain was registered on June 8, 2026, and remains operational as of July 12, 2026. Infrastructure analysis reveals the domain is hosted on Google Firebase, resolving to the IP address 199.36.158.100, with an SSL certificate issued by Google Trust Services. The page title explicitly displays 'Rabby Wallet,' aligning with the targeted brand. The domain appears on three security blocklists and is flagged by 3 of 95 security vendors in VirusTotal scans. Additional defensive measures include blocking by SEAL, MetaMask, and PhishDestroy. The Gridinsoft trust score for this domain is 0/100, further corroborating its malicious classification. No evidence of a phishing kit or specific attack vector has been confirmed at this stage, and the exact content of the page remains unanalyzed. Defenders should treat this domain as high-risk due to its active status, brand impersonation, and presence on multiple blocklists. Immediate blocking at the network and endpoint levels is recommended, alongside monitoring for related domains leveraging similar naming conventions or Firebase infrastructure. Further investigation into associated IP addresses and certificate details may reveal additional compromised or malicious assets.