rabbyikwallete[.]gitbook[.]io

Analysis indicates that rabbyikwallete.gitbook.io is an active brand impersonation domain targeting Rabby, a cryptocurrency wallet service. The domain, hosted under Cloudflare (AS13335), resolves to 104.18.40.47 and presents an HTTP 307 redirect status, a behavior often associated with intermediary phishing infrastructure. The page title, 'Rabby Wallet - Your Gateway to Gaming Prosperity | US,' explicitly references Rabby, reinforcing the impersonation intent. The domain was registered on March 30, 2014, though this date may reflect the creation of the parent gitbook.io platform rather than the specific subdomain's malicious use. Nameservers (dahlia.ns.cloudflare.com, hugh.ns.cloudflare.com) and SSL certificate (Google Trust Services / WE1) align with Cloudflare's standard configuration, providing no immediate anomalies but offering limited attribution value. Security vendors have flagged the domain, with 15 of 95 engines on VirusTotal detecting malicious activity, and it appears on one blocklist. The domain remains active as of July 12, 2026, with no evidence of takedown. Defenders should treat this domain as high-risk, particularly for users of Rabby Wallet, and consider blocking or monitoring traffic to this endpoint. Further investigation into the redirect chain and final landing page is recommended to confirm the exact phishing mechanism, though no direct observation of the site's content has been conducted.