rabby-web[.]app

This domain, rabby-web.app, presents a high-risk credential-theft phishing threat targeting users of the Rabby cryptocurrency wallet. The site mimics the official Rabby interface, presenting a page titled 'Rabby Wallet | Extension Download | Login' to deceive visitors into entering sensitive account credentials or downloading malicious browser extensions. Such activity typically aims to harvest login details, private keys, or seed phrases, enabling attackers to gain unauthorized access to victims' digital assets and wallets. The impersonation is designed to exploit trust in the Rabby brand, increasing the likelihood of successful compromise for users unfamiliar with official distribution channels. Analysis indicates that rabby-web.app was registered on April 14, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with suspicious domains. The domain resolves to the IP address 109.205.56.90 and is hosted on infrastructure utilizing Nginx. Detection metrics reveal significant concern among security vendors, with 21 out of 95 flagging the domain as malicious on VirusTotal. Additionally, the domain appears on four distinct security blocklists and has been assigned a trust score of 25/100 by Scamadviser and 0/100 by Gridinsoft, further corroborating its malicious nature. The combination of recent registration, low trust scores, and high detection rates underscores the domain's role in active phishing operations. Users who have visited rabby-web.app or interacted with its content should take immediate action to mitigate potential risks. First, cease all interaction with the domain and avoid entering any credentials or downloading files. If login details or private keys were submitted, revoke access to any associated wallets or accounts and transfer assets to a new, secure wallet. Monitor accounts for unauthorized transactions and enable multi-factor authentication where possible. Additionally, scan local devices for malware using updated security tools, as phishing sites may deploy malicious payloads. Report the domain to relevant security communities and wallet providers to assist in broader threat mitigation efforts.