learn-wallet-rabby-x[.]pages[.]dev

As of July 24, 2026, the domain learn-wallet-rabby-x.pages.dev has been confirmed as a high-risk Wallet/Seed phishing site targeting Aave users. This domain was created on November 08, 2025, and registered through Cloudflare, Inc. The site employs technologies such as HSTS, Cloudflare services, and HTTP/3, which can enhance its credibility and make it appear legitimate. The page title found is 'Rabby Wallet - Secure, Smart & Seamless Web3 Experience,' suggesting that it may attempt to mimic the Rabby Wallet interface or deceive users into believing it is an official Aave service. The domain has a Gridinsoft trust score of 0/100, indicating a complete lack of trustworthiness. It appears on one security blocklist and has been flagged by Google Safe Browsing for social engineering.

PhishDestroy has also marked the domain as blocked, further solidifying its reputation as a malicious site. The infrastructure analysis reveals that the domain resolves to the IP address 2606:4700:310c::ac42:2c9e, which is located in the United States and is part of the Cloudflare, Inc. network (AS13335). The SSL certificate is issued by Google Trust Services, which can add another layer of perceived legitimacy but should not be taken as a sign of safety given the domain's malicious nature. The HTTP status of the domain is 403, indicating that it is currently offline or that access is forbidden.

Despite this, the domain should still be considered a threat as it can be reactivated at any time. Defenders should immediately add this domain to their blocklists and monitor for any resurrections or related activity. Given that the site impersonates Aave, organizations and users involved with Aave or Rabby Wallet should be particularly vigilant and informed of this threat. Educating users about the risks of phishing and the importance of verifying URLs and SSL certificates can help mitigate the impact of such attacks.