rabbyairdrops[.]xyz

Analysis indicates that the domain rabbyairdrops.xyz was registered through Ultahost, Inc. on 14 October 2025 and resolves to IP 45.12.2.67, which is assigned to AS6698 Virtual Systems LLC in Ukraine. The site presented the page title “Rabby Wallet Airdrop – Claim Your Tokens,” and its content is classified as a “Fake Airdrop” impersonating Ethereum. No TLS certificate was observed, leaving the HTTP connection unencrypted. The domain was associated with an “Airdrop Scam” phishing kit and received a Gridinsoft trust score of 0 / 100, indicating a high confidence of malicious intent.

VirusTotal scans show that 14 of 95 antivirus engines flagged the domain as malicious. The domain appears on one external security blocklist and was taken offline after being blocked by the PhishDestroy remediation service. Nameserver configuration includes ns1.mezoairdrop.xyz, ns2.mezoairdrop.xyz, ns1.rabbyairdrops.xyz, and ns2.rabbyairdrops.xyz, suggesting shared infrastructure with other airdrop‑related domains. Because the site is no longer reachable, the exact payload and credential‑capture mechanisms could not be verified, and the visual fidelity of the impersonation remains unconfirmed.

Current status is offline, but the underlying infrastructure—IP address, hosting ASN, and registrar—remains observable and could be reused for future campaigns. Defenders should add rabbyairdrops.xyz to URL and domain blocklists, monitor traffic to 45.12.2.67 and the associated ASN for repeat activity, and apply sink‑hole or DNS‑level filtering for the listed nameservers. Continuous review of emerging airdrop‑related domains that reuse the same registrar or hosting provider is recommended to pre‑empt re‑deployment of the same phishing kit.