rabbywalet[.]wordpress[.]com

Analysis of rabbywalet.wordpress.com indicates that the site was hosted on the WordPress.com infrastructure and was taken offline, returning HTTP 410 Gone as of the report date. The page title retrieved from historical snapshots reads "Rabby Wallet: Secure Crypto Management Made Simple – Rabby Wallet – Crypto & EVM," which aligns with the declared scam type of a crypto‑related brand impersonation targeting the Rabby brand. The domain resolves to IP 192.0.78.12, belonging to AS2635 (Automattic, Inc.) and geolocated in the United States. The hosting stack includes Nginx, HTTP/3, HSTS, PHP, MySQL and the WordPress CMS, as indicated by server headers and technology fingerprinting. SSL was provided by Let’s Encrypt (certificate identifier E8), confirming the use of a valid TLS certificate despite the malicious content.

Registrar records show the domain was registered through MarkMonitor, Inc., and the nameserver set points to ns1‑ns4.wordpress.com, consistent with the WordPress.com hosting environment. VirusTotal scans recorded 7 detections out of 95 scanners, and the domain appears on a single external blocklist. PhishDestroy has already blocked the host. The combination of a deceptive page title, brand impersonation of "Rabby," and the crypto‑scam classification suggests that the site was designed to lure victims into disclosing wallet credentials or transferring cryptocurrency. Uncertainty remains regarding the specific phishing kit or payload used, as no sample pages or malicious scripts have been publicly released.

Additionally, it is unclear whether the domain’s creation date of 3 March 2000 reflects the original registration of the subdomain or a placeholder date inherited from the parent WordPress domain. Defenders should update URL filtering rules to include the full host name rabbywalet.wordpress.com, enforce blocklist entries, and monitor for any re‑registration attempts on the same sub‑domain. Network sensors should flag outbound connections to the IP 192.