mail[.]rabbywebextensions[.]io

The domain mail.rabbywebextensions.io was registered on March 13, 2026 through Sav.com, LLC and is presently taken offline. Infrastructure analysis shows the domain resolves to IP address 163.61.188.5, which is announced by AS153568 NEW DHAKA HARDWARE and geolocated to the United States. DNS resolution is handled by four lytehosting.com nameservers (dns1‑dns4.lytehosting.com). The site served a TLS certificate issued by Let’s Encrypt under the R12 profile, confirming the use of a publicly trusted certificate.

Web‑server technology identified includes LiteSpeed with Cloudflare front‑end services, while the front‑end code base incorporates Bootstrap, jQuery, jsDelivr, cdnjs, Google Analytics, and EmailJS. The page title returned by the server was "Rabby Wallet," directly indicating an attempt to impersonate the Rabby brand. VirusTotal scans recorded two positive detections out of 94 security vendors, and the domain appears on three public blocklists. It is actively blocked by PhishDestroy, MetaMask, and SEAL, confirming that multiple anti‑phishing services have flagged the site.

Reputation services assign a Gridinsoft trust score of 0 / 100, underscoring a lack of legitimacy. The threat is classified as a crypto‑related scam employing brand impersonation. While the offline status prevents real‑time interaction, defenders should continue to monitor the associated IP address and ASN for any reactivation, enforce blocking of the domain at network perimeter and DNS layers, and update phishing‑detection signatures to include the observed page title and certificate details. Additional investigation is required to determine whether any credential‑harvesting endpoints were ever active before takedown, but the available evidence already supports high‑confidence mitigation actions.