homes-rabbyy[.]wixstudio[.]com

The domain homes-rabbyy.wixstudio.com is identified as a brand impersonation threat targeting Rabby, a cryptocurrency wallet service. Analysis confirms the domain was designed to mimic the official Rabby Wallet, presenting itself as a legitimate source for downloading browser extensions. The page title, 'Rabby® Wallet® | Download Extension®,' reinforces this deception by using trademark symbols and branding elements associated with the authentic service. Currently, the domain is offline, but prior activity indicates a deliberate attempt to deceive users into installing malicious software under the guise of a trusted product. Infrastructure analysis reveals multiple technical indicators supporting the classification of this domain as malicious. The domain is flagged by 3 of 95 security vendors on VirusTotal, a notable discrepancy given the low detection rate often associated with newly deployed threats. It is also listed on three security blocklists: PhishDestroy, PhishingArmy, and OISD. The domain resolves to the IP address 34.144.206.118, hosted on Google Cloud infrastructure, a common tactic to leverage reputable cloud providers for short-term malicious campaigns. The SSL certificate is issued by Let's Encrypt, a free and widely used certificate authority, which does not inherently validate the legitimacy of the site. The domain was registered through GoDaddy.com, LLC, a registrar frequently utilized by both legitimate and malicious actors. Detected technologies include Wix as the hosting platform, React for frontend development, and Google Cloud CDN for content delivery, further indicating an attempt to create a polished, professional appearance to enhance credibility. Given the current offline status of homes-rabbyy.wixstudio.com, the immediate threat of direct interaction has been mitigated. However, the domain's prior activity and infrastructure characteristics warrant continued vigilance. Users who may have visited the site or downloaded content are advised to conduct a thorough security review of their systems, including scanning for unauthorized browser extensions, malware, or unauthorized access to cryptocurrency wallets. Organizations and individuals should monitor for similar impersonation attempts, particularly those leveraging cloud hosting and free SSL certificates to appear legitimate. Blocking the domain and associated IP address at the network level is recommended as a preventive measure. Additionally, users should verify the authenticity of any software downloads by accessing official sources directly, rather than relying on search engine results or third-party links.