rabbyrjwallet[.]gitbook[.]io

This domain, rabbyrjwallet.gitbook.io, has been identified as a high‑risk brand‑impersonation site targeting users of the Rabby Wallet ecosystem. The intelligence classifies the activity as a seed‑phish operation, indicating that the attacker likely harvests seed phrases or private keys. The site is currently active, returning an HTTP 307 redirect and presenting a valid SSL certificate issued by Google Trust Services under the WE1 designation. Infrastructure analysis shows the domain was created on 30 March 2014 and is hosted behind Cloudflare’s network (AS13335). Both authoritative nameservers, dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com, resolve to the IP address 172.64.147.209, which geolocates to the United States. Cloudflare’s HTTP/3 support is observed, and the TLS handshake is performed with a Google‑issued certificate, confirming the presence of a legitimate certificate chain despite the malicious intent. Detection signals reinforce the malicious profile. VirusTotal records 13 of 95 security vendors flagging the domain, and the site appears on a single external blocklist. Gridinsoft assigns a trust score of 0 out of 100, while PhishDestroy has already listed the domain as blocked. No additional public analysis of the page content is available, so the exact phishing landing page design and credential‑capture mechanisms remain unverified. Defenders should immediately add rabbyrjwallet.gitbook.io to network‑level deny lists and configure endpoint protection to flag any outbound connections to the associated IP address. Security monitoring solutions ought to watch for TLS connections using the Google Trust Services / WE1 certificate on that IP, as well as HTTP 307 responses that may indicate redirection to further malicious resources. Ongoing threat‑intel feeds should be consulted for any emerging indicators, and user‑education campaigns must warn Rabby Wallet users about unsolicited requests for seed phrases originating from this domain.