rabby-wllet[.]pages[.]dev

The domain rabby-wllet.pages.dev has been identified as a brand impersonation phishing site targeting users of the Rabby wallet platform, with a current status of offline. This domain is specifically designed to deceive visitors into believing they are accessing legitimate Rabby services, likely to steal login credentials or private keys. The domain is currently offline, but its previous activity already caused concern among security researchers and blocklists.

According to threat intelligence data, rabby-wllet.pages.dev was flagged by 9 out of 95 VirusTotal security vendors as malicious. Google Safe Browsing also marked it as a phishing site. The domain was registered on August 23, 2025, through Cloudflare, Inc., and resolves to IP address 172.66.44.107 with an SSL certificate issued by Google Trust Services (WE1). It appears on one security blocklist and had a page title of 'Suspected phishing site | Cloudflare' before being taken down. The unique seed for this analysis is e32381.

As the domain is currently offline, the immediate threat is neutralized, but users should remain vigilant for similar domains. PhishDestroy recommends that users always verify the authenticity of any website claiming to be associated with Rabby by double-checking the official URL. If you have already interacted with this domain, change your Rabby passwords and enable two-factor authentication immediately. Report any suspicious sites to PhishDestroy to help protect the community.