rabby[.]world

Analysis indicates that rabby.world was registered on March 07, 2026 and resolves to the IPv4 address 157.173.208.254, which belongs to AS47583 Hostinger International Limited located in the United States. The domain is hosted by Hostinger operations, UAB and uses the default parking nameservers ns1.dns-parking.com and ns2.dns-parking.com. No TLS certificate is presented, meaning the site was served only over HTTP before being taken offline. The page title returned by the server was “Rabby Wallet | Your Go-to Wallet for Ethereum and EVM”, aligning with the declared scam type of a crypto scam and the explicit impersonation of the Rabby brand.

VirusTotal scanned the domain and recorded a single positive detection out of 95 security vendors, confirming that at least one vendor flagged the site as malicious. The domain appears on three security blocklists and is specifically listed by PhishDestroy, MetaMask, and SEAL, indicating that multiple anti‑phishing services have already taken action. The current offline status suggests that the hosting provider has removed the content, but the underlying infrastructure remains observable and could be reused for future campaigns.

Uncertainty remains regarding the exact payload or credential‑ harvesting mechanisms because the site content has not been archived, and no additional threat‑intel sources such as OTX or Safe Browsing are referenced. Defenders should continue to block the IP address 157.173.208.254 at the network perimeter, add rabby.world to local deny lists, and monitor the Hostinger AS for new registrations that reuse the same nameserver pattern or similar page titles. Continuous re‑query of VirusTotal and blocklist feeds is recommended to capture any re‑activation attempts, and any future TLS certificates issued for this domain should be treated as suspicious.