login[.]rabbywallet[.]to

PhishDestroy identifies the domain login.rabbywallet.to as an active brand impersonation threat targeting Rabby, a popular cryptocurrency wallet. The domain has been assessed as posing an elevated risk due to its deliberate attempt to mimic Rabby’s official login interface, potentially leading to credential theft or unauthorized fund access. This domain exhibits multiple suspicious characteristics confirmed by independent threat intelligence sources. VirusTotal analysis reveals that 8 out of 95 security vendors have flagged login.rabbywallet.to as malicious, indicating a significant but not universal consensus on its harmful nature. The domain resolves to IP address 178.16.52.122 and was registered through the Government of the Kingdom of Tonga on January 28, 2026. Additionally, it utilizes a Let's Encrypt SSL certificate, which, while legitimate in isolation, is commonly abused in impersonation schemes to lend false credibility. The domain’s recent creation date and low trust scores further underscore its malicious intent. Given the confirmed malicious status and active nature of this domain, immediate action is required. Organizations and users are strongly advised to block login.rabbywallet.to at the network perimeter and DNS levels. Employees should be alerted to avoid interacting with the domain, especially in the context of cryptocurrency transactions. Rabby users must be notified to verify any login prompts via official channels only. Continuous monitoring of outbound connections to this domain is recommended to identify potential compromise within the network. Proactive threat hunting for similar impersonation domains is also encouraged to prevent broader exposure.