# PhishDestroy domain threat record: rabbysend.site Content language: English Canonical HTML report: https://phishdestroy.io/domain/rabbysend.site/ Machine-readable companion: https://phishdestroy.io/domain/rabbysend.site/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-21 19:01:00 UTC - Last availability or vendor check: 2026-10-22 22:51:17 UTC - Stored record updated: 2026-10-22 22:51:17 UTC - VirusTotal detections in the stored snapshot: 1/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Rabby - Phishing kit: Airdrop Scam ## Stored infrastructure - Observed IP address: 104.21.24.185 - Registrar in stored WHOIS data: Atak Domain Bilgi Teknolojileri A.Ş. - Registrar country in stored WHOIS data: TR - Last stored HTTP status: 200 - Registration date (registry RDAP, rabbysend.site): 2026-10-21 02:47:03 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a15fd5-977e-726a-8515-475d6c1ae11b/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/rabbysend.site - Certificate Transparency search: https://crt.sh/?q=%25.rabbysend.site - Web Archive lookup: https://web.archive.org/web/*/https://rabbysend.site/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s automated assessment classifies the domain as an Airdrop Scam targeting Rabby users. The site was first observed on 2026-10-21 serving a page titled “Rabby Airdrop” that invites visitors to connect a wallet to claim a token. An HTTP 200 response was recorded on that date. How the scam works A fake airdrop page typically asks a visitor to connect a cryptocurrency wallet in order to receive a promised token. Once the wallet address is supplied, the attacker can request token approvals or use the address for phishing, potentially draining funds if the user later authorizes transactions. Evidence VirusTotal recorded one malicious detection out of 92 engines on 2026-10-21, flagged by ChainPatrol. Google Safe Browsing reported no threat on the same date. OTX listed four pulses referencing the domain as of 2026-10-21. URLScan’s engine flagged the page as malicious with a score of 98 and phishing tags, while its overall verdict was non‑malicious. Cloudflare Radar identified the domain as phishing and noted it as a newly seen security risk. PhishDestroy lists the domain internally, and no external blocklists reported it at the time of checking. Infrastructure The domain was registered on 2026-10-21 through Atak Domain Bilgi Teknolojileri A.Ş., giving it a zero‑day age at first sight. Hosting is provided via Cloudflare, with recorded IP addresses 104.21.24.185 and 172.67.219.230 belonging to Cloudflare’s network. The TLS certificate is issued by Let’s Encrypt, valid until 2027-01-19, and DNSSEC is not enabled. What to do Do not connect a wallet to the site; if a connection was made, immediately revoke any token approvals and consider moving assets to a new wallet. Change any passwords entered on the page and monitor the wallet for unauthorized activity. Defenders should block rabbysend.site at the network perimeter, add it to internal blocklists, and review logs for any connections to the recorded Cloudflare IPs. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a15fd5-977e-726a-8515-475d6c1ae11b/ Cloudflare Radar report: https://radar.cloudflare.com/scan/4d74d553-1ab0-426d-b943-c3d5435295bf URLQuery report: https://urlquery.net/report/2254c4f1-526d-4f7d-b5f3-707e4dd10b9d Stored capture screenshot: https://i.ibb.co/FkHHwrTr/8884366ef459.png Cloudflare Radar screenshot (2026-10-21T19:01:18Z): https://screenshots.phishdestroy.io/cf/4d74d553-1ab0-426d-b943-c3d5435295bf.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/2254c4f1-526d-4f7d-b5f3-707e4dd10b9d.png URLScan screenshot (2026-10-21T19:03:16Z): https://screenshots.phishdestroy.io/us/01a15fd8-79ba-7334-bd46-1dc828b451e7.png URLScan capture report: https://urlscan.io/result/01a15fd8-79ba-7334-bd46-1dc828b451e7/ VirusTotal report: https://www.virustotal.com/gui/domain/rabbysend.site Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=rabbysend.site Revoke token approvals: https://revoke.cash/ Report crypto fraud (Chainabuse): https://www.chainabuse.com/report Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-21 21:26:09 UTC ## Stored page captures - Primary capture: https://i.ibb.co/FkHHwrTr/8884366ef459.png Captured: 2026-10-21 19:01:00 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a15fd5-977e-726a-8515-475d6c1ae11b.png Captured: 2026-10-21 19:01:00 UTC Source report: https://urlscan.io/result/01a15fd5-977e-726a-8515-475d6c1ae11b/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/4d74d553-1ab0-426d-b943-c3d5435295bf.png Captured: 2026-10-21 19:01:18 UTC Source report: https://radar.cloudflare.com/scan/4d74d553-1ab0-426d-b943-c3d5435295bf SHA-256: bec3e9346f7e493c2833b537cc85fd59160f108dd2b96a7c0254c78835112637 - URLQuery: https://screenshots.phishdestroy.io/uq/2254c4f1-526d-4f7d-b5f3-707e4dd10b9d.png Source report: https://urlquery.net/report/2254c4f1-526d-4f7d-b5f3-707e4dd10b9d SHA-256: 6272258c2d68630556e6129d94ac1fa560867ee798c7fa4ffda98a779c33c6cf - URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a15fd8-79ba-7334-bd46-1dc828b451e7.png Captured: 2026-10-21 19:03:16 UTC Source report: https://urlscan.io/result/01a15fd8-79ba-7334-bd46-1dc828b451e7/ SHA-256: 71f925da62d34bb5f9d4cb9e5cbb5a46b06beb634030e333988f3f0f43060f91 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T19:02:31Z", "uuid": "01a15fd5-977e-726a-8515-475d6c1ae11b", "scanned_at": "2026-10-21T19:00:06Z", "final_url": "https://rabbysend.site/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://rabbysend.site/", "from": "http://rabbysend.site/", "status": 307 } ], "ip": "172.67.219.230", "domains": [ "cdn.jsdelivr.net", "fonts.reown.com", "api.web3modal.org", "cca-lite.coinbase.com", "sf3-scmcdn-cn.feishucdn.com", "miaoda.feishu.cn" ], "ips": [ "2a06:98c1:310d::6812:230f", "2606:4700:10::6814:2e79", "104.18.18.237", "163.181.225.49", "104.17.208.5", "2606:4700::6811:cf05", "2409:8c70:3a04:5:8000:0:b00:112", "172.67.219.230" ], "asns": [ "13335", "24429", "9808" ], "countries": [ "DE", "US", "CN" ], "link_domains": [ "rabby.com", "chrome.google.com", "addons.mozilla.org" ], "doc_hash": "6e16743a3b16fbf3abbce1d6880ad67292a882d87c87043f3a886d74f7297387", "script_hashes": [ "fd66c04651929c6a37806a37e8217e6b6aac07c7e816ad478f52690b7429bc61", "78d9e918161dca4cdb20d4c28c9074240ee240306c4894f974e6eda4a6564713", "125da44da6cf189cb85cb022201d1974c39096ef9a710ec7f12e9b5b744783d1", "b35629f69a611b8eb1965c054b1d5b27791af2e1de7866e65bbe02d6253d82b4", "0ecca23a8ebc1e8b47e38f383cf8a9b379d172f3389312b6c440e3ea917fc083" ], "globals": [ "ethers", "toast", "getWalletInfo", "getDomain", "loadUserData", "clearUserData", "testWallet", "doSomething", "showLoading", "hideLoading", "do1", "CryptoJS", "Buffer", "global", "process", "litPropertyMetadata", "reactiveElementVersions", "litHtmlVersions", "litElementVersions", "myAppKit", "myWagmiAdapter", "walletAddress", "walletChainId", "walletBalance", "openWallet", "getWalletAddress", "getWalletChainId", "getWalletBalance", "requestPermit2Signature", "fetchWalletBalance", "_walletConnectCore__count", "_walletConnectCore_", "downloadAppKitLogsBlob", "ClientAnalytics", "__$G", "CONFIG", "ICONS", "hl", "toastTimer", "R" ], "cookies": [ "__cf_bm" ], "storage_keys": [ "wagmi.store", "@appkit/active_caip_network_id", "@appkit/active_namespace", "@appkit/connection_status", "-CBWSDK:VERSION", "@appkit/disconnected_connector_ids", "base-acc-sdk.store" ], "tls": { "san": [ "*.rabbysend.site", "rabbysend.site" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": "rabbysend.site", "protocol": "QUIC", "valid_to": "2027-01-19T06:15:33Z", "valid_from": "2026-10-21T06:15:34Z" }, "domain_age_days": 0, "apex_age_days": 0, "tls_age_days": 0, "tls_valid_days": 89, "requests": 389, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 98, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T19:02:32Z", "uuid": "4d74d553-1ab0-426d-b943-c3d5435295bf", "scanned_at": "2026-10-21T19:01:18Z", "final_url": "https://rabbysend.site/", "status": 200, "history": [ { "url": "https://rabbysend.site/", "status": 200 } ], "dom_hash": "baa00a956feb561b3d9ee63812f4612f46828717b78b1f8284a784a110971ed9", "doc_hash": "496295b3cfe8f50e701fbe0c2df732b61887531118e2232b4ec11174c6b51ac5", "phishing_v2": [ "phishing" ], "domain_risks": [ "Newly Seen Domains", "Security Risks" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "rabbysend.site", "type": "A", "value": "104.21.24.185" }, { "name": "rabbysend.site", "type": "A", "value": "172.67.219.230" }, { "name": "rabbysend.site", "type": "AAAA", "value": "2606:4700:3034::ac43:dbe6" }, { "name": "rabbysend.site", "type": "AAAA", "value": "2606:4700:3036::6815:18b9" } ], "dnssec_valid": false, "ip": "104.21.24.185", "whois": { "registrar": "Atak Domain Bilgi Teknolojileri A.Ş.", "created": "2026-10-21T02:47:03Z", "updated": "2026-10-21T07:06:44Z", "expires": "2027-10-21T02:47:03Z", "nameservers": [ "suzanne.ns.cloudflare.com", "todd.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-21T21:23:33Z", "analysis_at": "2026-10-21T19:02:31Z", "stats": { "timeout": 0, "harmless": 53, "malicious": 1, "suspicious": 0, "undetected": 38 }, "detections": { "ChainPatrol": "malicious" }, "reputation": 0, "registrar": "Atak Domain Bilgi Teknolojileri A.Ş.", "created": "2026-10-21T02:47:03Z", "expires": "2027-10-21T02:47:03Z", "updated": "2026-10-21T07:06:44Z", "first_seen": "2026-10-21T07:25:08Z", "dns": [ { "ttl": 300, "type": "A", "value": "104.21.24.185" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3034::ac43:dbe6" }, { "ttl": 300, "type": "A", "value": "172.67.219.230" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "suzanne.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3036::6815:18b9" }, { "ttl": 21600, "type": "NS", "value": "todd.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "suzanne.ns.cloudflare.com" } ], "dns_at": "2026-10-21T19:02:52Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.rabbysend.site", "rabbysend.site" ], "issuer": "Let's Encrypt / YE1", "serial": "6641f5677b933338e88f7f704b95984c663", "sha256": "15c3bb3e0f7664f53112fd743508364fae6517a2ed621b1ae6dc579a560bffa4", "subject": "rabbysend.site", "valid_to": "2027-01-19T06:15:33Z", "valid_from": "2026-10-21T06:15:34Z" }, "whois": { "registrar": "Atak Domain Bilgi Teknolojileri A.Ş.", "registrar_iana_id": "1601", "registrar_url": "https://www.atakdomain.com", "created": "2026-10-21T02:47:03Z", "updated": "2026-10-21T07:06:44Z", "expires": "2027-10-21T02:47:03Z", "status": [ "addPeriod", "clientTransferProhibited" ], "nameservers": [ "suzanne.ns.cloudflare.com", "todd.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "expiration": "2027-10-21T05:47:02Z", "last changed": "2026-10-21T05:47:02Z", "registration": "2026-10-21T05:47:02Z", "registrar expiration": "2027-10-21T05:47:02Z", "last update of RDAP database": "2026-10-21T05:47:05Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-21T19:02:54Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "rabbysend.site" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-21T19:01:53Z", "first": "2026-10-21T19:01:53Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 2241 }, "robots_txt": { "agents": [ "*", "Amazonbot", "Applebot-Extended", "Bytespider", "CCBot" ], "present": true }, "social_tags": { "title": "Rabby Airdrop", "description": "Rabby Airdrop — connect your wallet to claim the airdrop." }, "trackers": { "requests": 370, "trackers": [ { "name": "jsDelivr", "company": "jsDelivr", "category": "Hosting", "requests": 339 } ] }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 12, "tls": 22, "wait": 848, "connect": 7, "download": 0 }, "response_ms": 889 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 2058, "co2_grams": 0.0001, "cleaner_than": 95 }, "dns_server": { "ns": [ { "ip": "108.162.193.146", "host": "todd.ns.cloudflare.com" }, { "ip": "108.162.194.87", "host": "suzanne.ns.cloudflare.com" } ], "zone": "rabbysend.site" }, "location": { "ip": "2606:4700:3034::ac43:dbe6", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Let's Encrypt / YE1", "subject": "rabbysend.site" }, "dns": { "A": [ "172.67.219.230", "104.21.24.185" ], "NS": [ "todd.ns.cloudflare.com", "suzanne.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"suzanne.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418073788, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2606:4700:3034::ac43:dbe6", "2606:4700:3036::6815:18b9" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3034::ac43:dbe6", "family": 6 }, "redirects": { "chain": [ "https://rabbysend.site" ] }, "tech_stack": { "technologies": [ "lit-html", "lit-element", "crypto-js", "Cloudflare", "HTTP/3" ] }, "whois": { "registrar": "Atak Domain Bilgi Teknolojileri A.Ş.", "created": "2026-10-21T02:47:03Z", "updated": "2026-10-21T07:06:44Z", "expires": "2027-10-21T02:47:03Z", "status": [ "clientTransferProhibited https://icann.org/epp", "addPeriod https://icann.org/epp" ], "nameservers": [ "suzanne.ns.cloudflare.com", "todd.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html" } } } } ```