connect-rabbyy[.]wixstudio[.]com

This domain is currently under investigation for hosting a crypto wallet drainer, a form of generic phishing targeting cryptocurrency users. The site impersonates Rabby Wallet, a legitimate browser-based wallet extension, to deceive victims into connecting their wallets and signing malicious transactions that siphon funds. The threat type is classified as a wallet drainer, which poses a high financial risk to users unaware of the deception. Analysis indicates the domain connect-rabbyy.wixstudio.com resolves to the IP address 34.144.206.118, hosted on infrastructure associated with Wix Studio, a known website builder platform. VirusTotal reports zero detections out of 95 security engines (0/95), suggesting the domain has not yet been widely flagged by security vendors. The domain is actively resolving and operational as of the latest verification under seed 4fd8f0. No creation date metadata is publicly available due to the subdomain structure, and the domain has not been listed on major blocklists or assigned a trust score by reputation systems. Mitigation steps for this threat type include immediate verification of wallet connection requests. Users should cross-reference the domain name with the official Rabby Wallet site and avoid interacting with any unsolicited prompts to connect wallets. Wallet software should be updated to the latest version to ensure built-in phishing protections are active. Network-level blocking of the IP address 34.144.206.118 and the domain connect-rabbyy.wixstudio.com is recommended for organizations to prevent access. Users who have interacted with the domain should revoke any connected wallet permissions and monitor their transaction history for unauthorized activity. Security teams are advised to monitor for similar subdomain patterns under wixstudio.com and other hosting platforms for related threats.