rabby[.]fi-v2[.]to

This domain, rabby.fi-v2.to, poses a direct threat as a crypto wallet impersonation site targeting users of the Rabby wallet service. Analysis indicates the site was designed to mimic legitimate Rabby interfaces, likely to harvest wallet credentials or deploy crypto drainer scripts. The domain specifically impersonates the official rabby.fi platform, using a deceptive subdomain structure (fi-v2) to create a false sense of authenticity and urgency, potentially tricking users into entering sensitive recovery phrases or private keys. Evidence supporting this assessment includes detection by 18 out of 95 security vendors on VirusTotal, with the domain registered on November 17, 2025, through the Government of Kingdom of Tonga registrar. Infrastructure analysis reveals the domain resolves to IP 172.67.172.31, hosted on Cloudflare infrastructure (AS13335), and appears on 2 security blocklists. The SSL certificate, issued by Google Trust Services (WE1), further corroborates the malicious intent, as threat actors commonly abuse legitimate certificate authorities to lend credibility to phishing sites. Users who visited rabby.fi-v2.to should immediately revoke any wallet permissions granted during the interaction and transfer assets to a new, secure wallet. All devices used to access the site should undergo a full malware scan, with particular attention to browser extensions or scripts that may have been installed. If credentials were entered, users must assume compromise and avoid reusing passwords or recovery phrases across other platforms. Monitoring for unauthorized transactions on associated blockchain addresses is critical, as crypto drainers may operate with delayed execution.