rabbn[.]co[.]com

The domain rabbn.co.com is a confirmed brand impersonation phishing site targeting Rabby, a cryptocurrency wallet provider. The site is currently suspended, but its intended threat was to deceive users into believing they were interacting with legitimate Rabby services, likely to steal login credentials or private keys. No drainer kit was detected on this domain.

Technical analysis reveals that rabbn.co.com is flagged by 1 of 95 VirusTotal vendors, including Gridinsoft, and appears on 1 security blocklist (PhishDestroy). Google Safe Browsing has not flagged the domain. The domain was registered on February 21, 2026, through Moniker Online Services LLC, and resolves to IP address 104.20.26.245, which is located in the United States and hosted by Cloudflare, Inc. (AS13335). The SSL certificate was issued by Let's Encrypt / E8, and the page title observed was 'Account Suspended.' The domain uses nameservers ns1.nic.co.com through ns4.nic.co.com, and employs Cloudflare and HTTP/3 technologies. Gridinsoft assigns a trust score of 0/100.

To stay safe, users who may have interacted with rabbn.co.com should immediately revoke any token approvals associated with their Rabby wallet and move funds to a new, secure wallet. Change all passwords for related accounts and enable two-factor authentication (2FA) where possible. Monitor accounts for unauthorized activity and report the domain to security blocklists like PhishDestroy or to Rabby's official support team.