rabby-wallet[.]to

Analysis of the domain rabby-wallet.to indicates a deliberate brand‑impersonation campaign targeting cryptocurrency users. The domain was registered through Spaceship, Inc. on May 25, 2025 and resolves to the IP address 18.66.122.51, which is hosted in Germany under Amazon’s AS16509 network. No SSL certificate was observed, meaning the site operates without HTTPS protection. The page title returned by the server, "Rabby Wallet | Your Go-to Wallet for Ethereum and EVM," directly references the legitimate Rabby Wallet product, reinforcing the impersonation intent.

The threat profile is classified as a crypto scam, and the domain is listed on a single security blocklist. PhishDestroy has already taken the site offline, and the domain appears on VirusTotal where nine of ninety‑five scanners flagged it as malicious. The brand target is recorded as "across," suggesting the campaign may be attempting to leverage the broader reputation of the Across brand alongside Rabby Wallet. Infrastructure evidence shows a single nameserver configuration, but further DNS details are not disclosed.

Defenders should continue to block the IP 18.66.122.51 and the domain rabby-wallet.to at perimeter filters, monitor for any resurgence of the host on other cloud providers, and enforce strict TLS requirements for wallet‑related traffic to prevent credential harvesting. Because the site is currently offline, ongoing surveillance is recommended to detect any re‑hosting attempts or related infrastructure changes. The combination of brand‑specific page title, lack of encryption, and multi‑vendor detection confirms a credible impersonation threat that warrants continued mitigation.