rabbywalletsext[.]com

Analysis of rabbywalletsext.com, created on 16 December 2025 and registered through Sav.com, LLC, indicates an active high‑risk brand‑impersonation operation targeting the Arbitrum ecosystem. The domain resolves to IP address 163.61.188.2, which is announced by AS153568 NEW DHAKA HARDWARE and geo‑located in the United States. The site serves HTTP status 200 responses and is hosted on a Caddy web server; Google Analytics and HTTP/3 are also detected, suggesting a modern delivery stack. No TLS certificate is present, leaving the connection unencrypted.

The authoritative name servers are dns1.lytehosting.com, dns2.lytehosting.com, dns3.lytehosting.com, and dns4.lytehosting, and the MX record points to mx.all-harmless.domains with priority 10. Security‑vendor telemetry shows the domain appears on four blocklists and has been flagged by PhishDestroy, Polkadot, Enkrypt, and Codeesura. AlienVault OTX lists the domain in a single threat‑intel pulse, and VirusTotal reports ten of ninety‑five scanners labeling the site as malicious. Gridinsoft assigns a trust score of zero out of one hundred.

The page title "Rabby Wallet" and the declared scam type "Crypto Scam" corroborate the intent to deceive users of the Arbitrum platform. While the exact phishing landing page content has not been disclosed, the combination of brand impersonation, lack of encryption, and multiple vendor detections substantiates a high‑confidence malicious classification. Defenders should add the domain, its IP address, and the associated name servers to blocklists, enforce DNS‑level denial, and monitor outbound traffic for connections to the listed MX host. Continuous re‑evaluation is advised in case the infrastructure evolves or additional indicators emerge.