rabby-app[.]com

Analysis of rabby-app.com, created on 10 September 2025 through Web Commerce Communications Limited, shows that the domain resolves to 188.114.97.3, an address owned by Cloudflare (AS13335) located in the United States. The authoritative nameservers are ariadne.ns.cloudflare.com and rohin.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. No TLS certificate is presented; HTTP connections are therefore unencrypted. The page title returned by the live host, before it was taken offline, was “Rabby Wallet”, and the domain is explicitly listed as impersonating the Arbitrum brand. The threat classification in the intelligence set is “Wallet/Seed Phishing”, indicating an attempt to harvest cryptocurrency wallet credentials or seed phrases.

Detection metrics show a gridinsoft trust score of 0 out of 100 and a presence on a single security blocklist. VirusTotal scans reported 15 of 95 antivirus engines flagging the domain as malicious, reinforcing the suspicion of phishing activity. PhishDestroy has also blocked the domain. The combination of a brand‑specific impersonation, a wallet‑related page title, and multiple vendor detections suggests an active phishing campaign targeting users of the Arbitrum ecosystem.

Uncertainty remains regarding the exact content served before takedown, as no SSL certificate and no current HTTP response can be inspected. The lack of additional blocklist listings limits visibility into the broader distribution of the infrastructure. Defenders should add rabby‑app.com to URL filtering and DNS block policies, monitor for connections to 188.114.97.3, and enforce multi‑factor authentication for wallet access. Incident response teams should also flag any credential submissions referencing Arbitrum or Rabby Wallet for potential compromise.