rabbyiwallet[.]wordpress[.]com

PhishDestroy identifies rabbyiwallet.wordpress.com as an active brand impersonation campaign targeting Rabby, a cryptocurrency wallet platform. This domain is part of a malicious operation designed to deceive users into connecting their wallets to a crypto drainer, enabling unauthorized asset transfers. The site mimics the legitimate Rabby branding to exploit trust and steal funds, leveraging a familiar platform (WordPress) to appear credible. Technical analysis confirms this domain resolves to IP 192.0.78.12 and utilizes a Let's Encrypt SSL certificate, further masking its malicious intent by presenting a false sense of security through HTTPS encryption. This domain exhibits multiple red flags across security platforms. VirusTotal shows only 2 out of 95 security vendors flagging the domain, highlighting the importance of independent verification. The registrar is MarkMonitor, Inc., a legitimate service often abused for large-scale domain registrations. The domain was created on March 03, 2000, an unusually old registration date for a newly active scam, suggesting a previously dormant domain was repurposed. It is flagged on 1 security blocklist and is actively blocked by MetaMask, indicating widespread recognition of its malicious nature. These indicators collectively demonstrate a well-coordinated but identifiable threat. As of the latest assessment, rabbyiwallet.wordpress.com remains an active threat under PhishDestroy’s monitoring. Immediate response actions include domain blacklisting and user warnings via MetaMask and other crypto-security tools. However, the remaining risk is elevated due to the domain’s age, seemingly legitimate infrastructure, and low detection rates among automated systems. Users are strongly advised to verify all wallet-related domains against PhishDestroy’s database before any interaction. Failure to do so risks irreversible financial loss through cryptocurrency drainer attacks.