rabby-wallet[.]com[.]mx

rabby-wallet.com.mx is a newly registered domain (created July 10, 2026) that resolves to the IPv4 address 209.74.82.247. The domain is hosted by nameservers a.dnspod.com, b.dnspod.com and c.dnspod.com, and was registered through Registrar.eu. Intelligence categorises the domain as a crypto‑drainer infrastructure and its current status is active, with the risk level marked as under investigation. The only concrete artifacts available are the registration metadata and the resolved IP address; no additional payload, page content, or malware analysis has been published. Consequently, the precise mechanism used to target cryptocurrency wallets remains unknown, as does any affiliation with known threat actors or campaigns. Defenders should treat the IP 209.74.82.247 as malicious for the purpose of network filtering and block DNS resolution for rabby‑wallet.com.mx at perimeter devices. Continuous monitoring of DNS queries and outbound connections to this address is advised, as is the inclusion of the domain in threat‑intel feeds. Analysts should seek further evidence by inspecting traffic that contacts the IP, checking for wallet‑related API calls, and correlating any observed cryptocurrency transaction attempts with this infrastructure. Until additional indicators are uncovered, the domain should be considered a high‑confidence indicator of a crypto‑drainer operation.