extension-rabby-wallet-easily[.]pages[.]dev

The domain extension-rabby-wallet-easily.pages.dev is a confirmed phishing site engaged in brand impersonation targeting Rabby, a cryptocurrency wallet service. This scam specifically poses as a legitimate Rabby extension or wallet interface to deceive users into disclosing sensitive information or transferring cryptocurrency. No drainer kit was identified, but the site operated as a cryptocurrency phishing page before being taken offline.

Technical indicators confirm the malicious nature of extension-rabby-wallet-easily.pages.dev. As of analysis, 1 of 95 VirusTotal security vendors flagged the domain, while it appeared on 1 security blocklist (PhishDestroy). The domain was registered through Cloudflare, Inc. on October 08, 2025, and resolved to the IP address 172.66.44.125, hosted by Cloudflare in the US. The SSL certificate was issued by Google Trust Services (WE1), and the observed page title was 'Suspected phishing site | Cloudflare'. Technologies detected included HSTS, Cloudflare, and HTTP/3, with an HTTP status of 403 returned upon access. Google Safe Browsing did not flag the domain at the time of assessment.

Users who interacted with extension-rabby-wallet-easily.pages.dev should immediately revoke any token approvals granted to suspicious contracts and transfer remaining funds to a new, secure wallet. If credentials or private keys were entered, change passwords and enable two-factor authentication (2FA) on all related accounts. Monitor transaction histories for unauthorized activity and report the phishing domain to platforms such as Google Safe Browsing, PhishTank, or the impersonated brand (Rabby) for further action.