rabbyrectifier[.]pro

Analysis of the domain rabbyrectifier.pro indicates it was actively involved in a cryptocurrency scam impersonating the Rabby wallet brand. The domain was registered through Cloudflare, Inc., and utilized Cloudflare nameservers (conrad.ns.cloudflare.com and zelda.ns.cloudflare.com). It resolved to the IPv6 address 2606:4700:3034::6815:2106, hosted on Cloudflare's infrastructure (AS13335) in the United States. No SSL certificate was detected, increasing the likelihood of interception or tampering during user interactions.

The domain was flagged by two security blocklists, PhishDestroy and ScamSniffer, and was included in one AlienVault OTX threat intelligence pulse. VirusTotal detections showed 15 of 95 security vendors marked the domain as malicious, reinforcing its classification as a high-risk resource. The page title, 'Phantom - Bridge Problems Fixer,' suggests an attempt to deceive users by posing as a tool for resolving cryptocurrency bridge issues, though the exact content and functionality of the site remain unconfirmed due to its current offline status. Infrastructure analysis reveals the domain was taken offline prior to the report date of July 23, 2026, limiting further real-time assessment.

Defenders should treat this domain as part of a broader crypto scam campaign targeting Rabby wallet users. Historical DNS and WHOIS records should be reviewed for additional indicators of compromise, and any residual references to the domain in logs or threat feeds should be purged to prevent accidental exposure. Given the domain's association with known blocklists and detection vendors, organizations are advised to maintain blocking rules for this resource until further evidence confirms its permanent deactivation.