mickeymouseforlandi[.]com

This domain poses a significant threat as a brand impersonation site targeting users of Rabby, a cryptocurrency wallet for Ethereum and EVM-compatible networks. The site presents itself as the legitimate Rabby Wallet, using identical branding, page titles, and design elements to deceive visitors into entering sensitive credentials or connecting their wallets. Such impersonation attacks are commonly used to facilitate crypto drainers, where attackers gain unauthorized access to victims' wallets and siphon funds. The site's infrastructure and content are engineered to exploit trust in the Rabby brand, making it particularly dangerous for users unfamiliar with phishing tactics. Analysis indicates this domain is actively malicious, with concrete technical indicators supporting its classification. The domain was registered on April 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with suspicious domains. It resolves to the IP address 188.114.97.3 and employs Cloudflare with HTTP/3, a configuration often used to obfuscate malicious activity. On VirusTotal, 10 out of 95 security vendors flag the domain as malicious, while it appears on three security blocklists and has been documented in one AlienVault OTX threat intelligence pulse. The Gridinsoft trust score of 0/100 further corroborates its high-risk status. Additionally, the domain is blocked by MetaMask, PhishDestroy, and SEAL, reinforcing its association with crypto-related threats. Users who have visited mickeymouseforlandi.com or interacted with its content should take immediate action to mitigate potential risks. First, disconnect any wallets or accounts linked to the site and revoke any permissions granted via wallet connection prompts. Monitor all connected wallets and accounts for unauthorized transactions, and consider transferring assets to a new, secure wallet if suspicious activity is detected. Change passwords for any accounts where credentials may have been entered on the site, and enable multi-factor authentication where available. Report the domain to relevant platforms, such as cryptocurrency exchanges or wallet providers, to aid in broader threat mitigation efforts. Finally, scan local devices for malware using updated security tools to ensure no additional compromise has occurred.