rabby[.]wallet-login[.]live

On 23 February 2026 the domain rabby.wallet-login.live was registered. The site was observed serving a page titled “Rabby Wallet | Extension Download | Login”, clearly targeting users of the Rabby cryptocurrency wallet extension. The page title and the brand target indicate a brand‑impersonation crypto scam aimed at harvesting credentials or installing malicious extensions. No TLS certificate was presented, meaning the site operated over plain HTTP, which further reduces user trust. Infrastructure analysis shows the domain resolves to IP address 188.114.96.3, an address owned by Cloudflare, Inc. (AS13335) and located in the United States. The hosting provider does not appear to be directly compromised, but the use of a reputable CDN suggests the operators sought anonymity and rapid content delivery.

Detection data from VirusTotal records three of ninety‑three antivirus engines flagging the domain as malicious, corroborating the suspicion of malicious intent. The domain is listed on three external blocklists and has been actively blocked by the phishing‑specific services PhishDestroy, MetaMask, and SEAL. These multiple independent detections increase confidence that the site is part of an organized impersonation campaign rather than a one‑off typo‑squatting test. The site’s current status is offline, indicating that the operators have either removed the content or are rotating infrastructure. Because the domain was active for only a few months, the full scope of the campaign—such as additional landing pages, associated command‑and‑control servers, or the malware payload delivered—remains unknown.

No evidence of additional infrastructure, such as secondary domains or email‑based phishing kits, has been disclosed. Defenders should add rabby.wallet-login.live to URL filtering and domain block lists across web gateways, DNS resolvers, and endpoint protection solutions. Monitoring for new domains that share the “wallet-login.