raabbydnwallet[.]gitbook[.]io

Analysis of the domain raabbydnwallet.gitbook.io indicates an active brand impersonation campaign targeting Ethereum users, specifically mimicking the Rabby Wallet, an Ethereum-compatible wallet service. The domain was registered on March 30, 2014, through Cloudflare, Inc., and currently resolves to the IP address 172.64.147.209. Infrastructure analysis reveals the use of Cloudflare services, including HTTP/3 and an SSL certificate issued by Google Trust Services, which may complicate detection and takedown efforts due to the protective measures these services provide. As of July 12, 2026, the domain remains active and is flagged by 11 of 95 security vendors on VirusTotal, suggesting moderate detection but not universal recognition as malicious. The domain appears on at least one security blocklist and is explicitly blocked by PhishDestroy. The page title, 'Rabby Wallet | Your Alternative Ethereum-Compatible Wallet - us,' directly aligns with the impersonation of the legitimate Rabby Wallet, a known Ethereum wallet provider, increasing the likelihood of successful social engineering attacks against users familiar with the brand. The Gridinsoft trust score of 0/100 further corroborates the malicious classification of this domain. While the exact content and functionality of the site have not been analyzed, the combination of brand impersonation, active status, and security vendor detections indicates a high-risk threat. Defenders should prioritize blocking this domain at the network level and monitor for related infrastructure, such as associated IP addresses or additional domains registered through the same registrar. Given the use of Cloudflare, additional scrutiny of domains leveraging similar protective services may be warranted to identify potential evasion tactics.