rabbywalleitt[.]gitbook[.]io

rabbywalleitt.gitbook.io is an active domain that has been identified as a brand impersonation site targeting the Rabby wallet. The domain was originally registered on March 30, 2014 and is currently hosted behind Cloudflare, as indicated by the nameservers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com and the resolving IP 104.18.40.47 belonging to AS13335 Cloudflare, Inc. The site serves content over HTTPS using a certificate issued by Google Trust Services under the WE1 intermediate, and the connection negotiates HTTP/3. An HTTP 307 redirect response is observed, suggesting redirection behavior, though the final landing page has not been captured in this analysis. The page title presented by the server is "Rabby Wallet - Your Alternative Ethereum-Compatible Wallet | Rabby Wallet", which directly references the legitimate Rabby brand, confirming the impersonation intent. Threat intelligence shows the domain appears on one public security blocklist and is specifically listed by PhishDestroy.

VirusTotal analysis reports 13 detections out of 95 scanned security vendors, reinforcing the malicious classification. The Gridinsoft trust score of 0 out of 100 further indicates a lack of trustworthiness. No additional evidence such as malware samples or phishing page screenshots is available, leaving the exact content and credential‑harvesting mechanisms unverified. Given the observed infrastructure, defenders should immediately block traffic to rabbywalleitt.gitbook.io at network perimeter and update URL filtering feeds.

Continuous monitoring of Cloudflare‑hosted subdomains for similar brand‑impersonation patterns is recommended, as the same infrastructure can be leveraged for rapid re‑deployment. Analysts should also query passive DNS and SSL certificate transparency logs for new aliases that resolve to the same IP range.