rabbywalet-app[.]pineapple[.]page

This domain, rabbywalet-app.pineapple.page, is flagged as a high-risk brand impersonation threat targeting Arbitrum, a prominent cryptocurrency platform. Analysis indicates the infrastructure was designed to mimic legitimate Arbitrum services, likely aiming to harvest user credentials or facilitate unauthorized transactions. The page title, "Trezor Suite – Advanced Security for Crypto Management," suggests an attempt to deceive users by presenting a false sense of security associated with a well-known hardware wallet brand, further increasing the likelihood of successful credential theft or crypto drainer deployment. Infrastructure analysis reveals the domain resolves to IP address 216.150.16.1, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. The domain was registered through Vercel Inc. and is currently associated with a Let's Encrypt SSL certificate (R13). Google Safe Browsing explicitly flags this domain as phishing, while VirusTotal reports detection by 13 out of 95 security vendors. Additionally, the domain appears on one security blocklist, corroborating its malicious classification. No creation date was provided, but the combination of technical indicators strongly supports its role in fraudulent activity. As of the latest assessment, rabbywalet-app.pineapple.page has been taken offline, likely in response to security vendor interventions or hosting provider actions. However, the residual risk remains elevated due to the domain's prior association with credential theft infrastructure. Users who interacted with this domain should immediately revoke any connected wallet permissions, rotate credentials, and monitor accounts for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts. The use of Arbitrum branding in this campaign underscores the need for heightened scrutiny of domains mimicking cryptocurrency platforms.