rabbittx-exchange-en-io[.]pages[.]dev

The domain rabbittx-exchange-en-io.pages.dev is identified as a high-risk threat, specifically a brand impersonation targeting Rabby. No drainer kit has been detected, but the domain is designed to deceive users into believing they are interacting with legitimate Rabby services.

Analysis indicates that the domain has been flagged by VirusTotal with a score of 10/95, suggesting that it is recognized by a significant number of security vendors as potentially malicious. The domain is registered through Cloudflare, Inc., and resolves to the IP address 188.114.97.3, located in the United States under the ASN AS13335. The domain was created on October 16, 2025, and is currently flagged as a phishing site by Google Safe Browsing. It also appears on one security blocklist and is blocked by PhishDestroy.

The domain is currently taken offline, which mitigates the immediate risk to users. However, it is recommended that organizations and individuals who may have interacted with this domain conduct a thorough review of their security logs and user accounts for any unauthorized activity. The domain's association with Cloudflare and its IP location suggest a possible use of Cloudflare's services to mask the origin of the threat. Despite being offline, the domain remains a potential indicator of a broader, ongoing campaign targeting Rabby users, and continued vigilance is advised.