rabbys[.]at

This domain is flagged as an elevated-risk brand impersonation site specifically designed to deceive cryptocurrency users. Analysis indicates the site mimics the legitimate Rabby Wallet interface to distribute malicious browser extensions or crypto drainer malware, targeting users of the Across protocol. The threat type is classified as brand impersonation with secondary crypto asset theft capabilities, given the context of the page title and known attack patterns associated with similar domains. Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain rabbys.at resolves to IP address 46.173.214.32, hosted on AS47196 (Garant Park Internet) in Russia, a network frequently associated with malicious hosting. The SSL certificate is issued by Let's Encrypt (R13), a common choice for threat actors due to its free and automated issuance process. The domain is registered through Gransy s.r.o. (registrar ID 609), a registrar previously linked to abusive registrations. At the time of analysis, 19 out of 95 security vendors on VirusTotal flagged the domain as malicious. The domain appears on one security blocklist and was blocked by PhishDestroy prior to being taken offline. The page title, 'Rabby Wallet | Download Extension | Crypto & NFT Wallet,' directly impersonates the legitimate Rabby Wallet brand to lure victims. Organizations and individuals are advised to implement the following mitigation measures to counter this specific threat type. Block the domain rabbys.at and its resolving IP 46.173.214.32 at the network perimeter to prevent access. Add the domain to endpoint protection and email security blocklists to disrupt potential delivery vectors. Monitor for indicators of compromise, including unauthorized crypto wallet transactions or unexpected browser extension installations. Users who interacted with the site should revoke permissions for any installed browser extensions and transfer crypto assets to new wallets. Security teams should conduct retrospective analysis to identify any prior exposure within their networks. Given the brand impersonation tactics, user education should emphasize verifying official download sources for crypto wallet software and scrutinizing domain names for subtle misspellings or homoglyphs.