rabby-io-view-wellett[.]tem3[.]io

PhishDestroy identifies rabby-io-view-wellett.tem3.io as a high-risk fake-wallet phishing domain designed to trick users into surrendering cryptocurrency wallet credentials. The site masquerades as the legitimate Rabby wallet interface, luring visitors with plausible branding while secretly harvesting private keys or seed phrases. Security vendors have already caught on: 12 out of 95 VirusTotal engines now flag the domain, and MetaMask has blocked access outright. With a newly registered domain (August 02, 2024) and hosting on ASN 13335 (Cloudflare), this page is engineered for deception, not legitimate use. This domain was flagged through multiple threat-intelligence pipelines. Google Safe Browsing classifies it under “SOCIAL_ENGINEERING,” indicating active attempts to manipulate users into harmful actions. The SSL certificate is issued by Google Trust Services, giving a false veneer of legitimacy, yet the underlying registrar is GoDaddy.com, LLC and the site resolves to IP 188.114.96.3 (ASN 13335). The combination of a freshly minted domain, low VT detection coverage early on, and heavy reliance on Cloudflare hosting is typical of fast-moving phishing campaigns that pivot quickly to evade takedowns. If you visited rabby-io-view-wellett.tem3.io, immediately disconnect from the internet, close your browser, and open a fresh session. Do not enter any wallet passwords, seed phrases, or private keys. Scan your device with an up-to-date antivirus suite; consider rotating all online wallet credentials as a precaution. Report the domain to your browser’s safe-browsing program and the wallet provider’s official incident channel so the blocklists can be updated swiftly. Treat any assets stored in wallets that may have been exposed as potentially compromised and move them to a clean, air-gapped wallet if you suspect interaction.