rabby-wallet[.]org

The domain rabby-wallet.org is a confirmed phishing site engaged in brand impersonation targeting cryptocurrency users. It mimics the Arbitrum ecosystem, presenting itself as the Rabby Wallet to deceive victims into downloading malicious software or disclosing sensitive information. This scam operates as a cryptocurrency phishing scheme, though no active drainer kit was identified. As of the latest verification, rabby-wallet.org has been taken offline.

Technical indicators confirm the malicious nature of rabby-wallet.org. The domain was flagged by 1 of 95 VirusTotal security vendors, including Gridinsoft, which assigned a trust score of 0/100. It appears on 1 security blocklist, PhishDestroy, and was registered through NameSilo, LLC on September 21, 2025. The domain resolves to the IP address 104.21.43.251, hosted on Cloudflare's network (AS13335) in the US, with nameservers damian.ns.cloudflare.com and sierra.ns.cloudflare.com. No SSL certificate was issued for the site, and the observed page title was in Russian: 'Rabby Wallet - Безопасный мультичейн кошелек для Ethereum и EVM сетей | Скачать бесплатно'.

Users who interacted with rabby-wallet.org should immediately revoke any token approvals granted to unknown contracts and transfer funds to a new, secure wallet. If credentials were entered, change passwords for all associated accounts and enable two-factor authentication. Monitor financial and cryptocurrency accounts for unauthorized transactions. Report the phishing domain to the impersonated brand, Arbitrum, and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in takedown efforts.