rabbywallet[.]space

Analysis indicates that the domain rabbywallet.space was created on July 28, 2026 and registered through Name.com, Inc. The domain resolves to the IP address 216.198.79.65 and is served by nameservers ns1.vercel-dns.com and ns2.vercel-dns.com, suggesting the infrastructure is hosted on Vercel's DNS platform. VirusTotal has recorded three detections out of ninety‑one scanning engines, confirming that a minority of security vendors have identified malicious activity associated with the domain. Independent blocklist services, including PhishDestroy, MetaMask, and SEAL, have explicitly blocked rabbywallet.space, and the domain appears on three additional security blocklists, reinforcing its classification as a high‑risk asset.

The threat type is identified as a crypto drainer, indicating that the site is likely intended to illicitly capture cryptocurrency credentials or redirect transactions to attacker‑controlled wallets. No publicly available data on SSL certificates, HTTP response codes, page titles, or content analysis is present in the current intelligence set, leaving the exact payload and user‑facing behavior uncertain.

Defenders should proactively block traffic to 216.198.79.65 and to rabbywallet.space at the DNS and firewall layers, add the domain to internal blocklists, and monitor for any attempted connections from internal hosts. Continuous re‑scanning with multi‑engine services is advised to capture any evolving indicators, and incident response teams should be prepared to investigate any credential theft reports that reference the domain or its associated IP address.