rabby-points[.]click

This domain is classified as a high-risk brand impersonation threat specifically targeting Rabby, a cryptocurrency wallet service. Analysis indicates the infrastructure was designed to deceive users into believing they were interacting with legitimate Rabby services, likely to facilitate unauthorized transactions or credential harvesting. The domain exhibits multiple indicators of malicious intent, including its recent registration and widespread detection across security platforms. Infrastructure analysis reveals the domain rabby-points.click was registered on June 02, 2026, through NameSilo, LLC. It appears on four security blocklists, including MetaMask, PhishDestroy, SEAL, and InversionDNS, and is flagged by 12 out of 95 security vendors on VirusTotal. Google Safe Browsing categorizes the domain under SOCIAL_ENGINEERING, and AlienVault OTX includes it in four threat intelligence pulses. The domain is currently offline, but its prior activity and detection patterns suggest it was actively used in a coordinated impersonation campaign. Mitigation for this type of threat involves several technical and procedural controls. Organizations should ensure endpoint protection systems are configured to block domains flagged for brand impersonation, particularly those targeting financial or cryptocurrency services. Users should be educated on verifying domain authenticity, including checking for subtle misspellings or unusual top-level domains, and confirming SSL certificates match the legitimate service. Additionally, network-level monitoring should be implemented to detect and block connections to newly registered domains exhibiting high-risk characteristics, such as those registered within the last 30 days and flagged by multiple threat intelligence sources.