support[.]rabby[.]io[.]import-verification[.]live

PhishDestroy assesses support.rabby.io.import-verification.live as a high-risk domain engaged in brand impersonation, specifically masquerading as Rabby Wallet to target Ethereum users. This is a classic crypto drainer scheme designed to trick visitors into connecting their wallets or revealing private keys, leading to asset theft. The domain employs a deceptive page title claiming to be "Rabby Wallet" and utilizes a Let's Encrypt SSL certificate (R12) to appear legitimate, lowering user suspicion.

Technical indicators paint a clear picture of malicious intent. VirusTotal reports 10 out of 95 security vendors flagging the domain, and Google Safe Browsing lists it as phishing. The domain was registered on April 30, 2025, through Name.com, Inc, and resolves to IP address 89.34.227.168. It currently appears on one security blocklist and has a low trust score. Although the domain is now offline, its brief active period underscores the speed at which threat actors operate and the importance of timely detection.

To protect against such threats, users should always verify the exact URL before interacting with any crypto wallet site—official Rabby Wallet domains are rabby.io or app.rabby.io. Never enter seed phrases or private keys on third-party sites, and avoid connecting hardware wallets to unknown dApps. Enable browser-based phishing protection, use a hardware wallet with transaction preview, and report any suspicious domains to security platforms. If credentials were entered on this site, immediately transfer funds to a new wallet and revoke any token approvals via tools like revoke.cash.