rarbeywaletd[.]gitbook[.]io

Analysis of the domain rarbeywaletd.gitbook.io indicates active brand impersonation targeting Ethereum users, classified as high-risk. The domain, registered on March 30, 2014, through Cloudflare, Inc., currently resolves to the IP address 172.64.147.209. Infrastructure analysis reveals the use of Cloudflare services and HTTP/3, with an SSL certificate issued by Google Trust Services. The page title, 'Rabby Wallet | Your Alternative Ethereum-Compatible Wallet,' explicitly references Ethereum, aligning with the observed threat type of brand impersonation. Security vendor detections include 13 flags out of 95 on VirusTotal, while Google Safe Browsing classifies the domain under 'SOCIAL_ENGINEERING.' The domain appears on one security blocklist and is actively blocked by PhishDestroy. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious classification. Despite the domain's long registration history, its current activity and detection metrics suggest it is being actively exploited for phishing purposes. Defenders are advised to treat this domain as malicious and prioritize blocking or monitoring access to it. The exact content and functionality of the site remain unanalyzed, but the combination of brand impersonation, social engineering flags, and security vendor detections provides sufficient evidence for mitigation. No additional details regarding the phishing kit, campaign duration, or victim targeting are available at this time.