rabby-wallet[.]xyz

This domain, rabby-wallet.xyz, is identified as a brand-impersonation threat targeting Rabby, a cryptocurrency wallet service. Analysis indicates the infrastructure is designed to deceive users into divulging wallet credentials or authorizing fraudulent transactions, likely deploying a drainer kit to siphon digital assets. The domain mimics legitimate Rabby interfaces, increasing the likelihood of successful social engineering attacks against unsuspecting victims. Infrastructure analysis reveals the following technical indicators: the domain was registered on March 28, 2026, through NameSilo, LLC, and currently resolves to the IP address 104.21.78.124. VirusTotal reports 9 out of 95 security vendors flagging the domain as malicious. The domain appears on three security blocklists and was previously detected in one threat intelligence pulse on AlienVault OTX. The page title, 'Just a moment...,' suggests the use of evasion techniques, such as cloud-based filtering or cloaking, to avoid detection or analysis. As of the latest assessment, rabby-wallet.xyz has been taken offline, reducing immediate exposure. However, residual risk remains due to the potential reuse of associated infrastructure or registration of similar domains. Users who interacted with the domain should revoke any suspicious wallet authorizations, monitor for unauthorized transactions, and verify the legitimacy of any communications claiming to be from Rabby. Organizations should update blocklists to include this domain and its resolved IP to prevent future access attempts.