see-rabby-wallet[.]pages[.]dev

This domain presents a high-risk brand impersonation threat designed to deceive users into believing they are interacting with the legitimate Rabby Wallet, a multi-chain DeFi wallet. The page title, 'Rabby Wallet: Secure & Smart Multi-Chain DeFi Wallet,' directly mimics the authentic service, while the domain structure leverages a subdomain under pages.dev to appear credible. The intended target is users of the Across protocol, a cross-chain bridging platform, suggesting the campaign aims to exploit trust in decentralized finance (DeFi) infrastructure to facilitate unauthorized transactions, credential harvesting, or crypto asset theft. Analysis of technical indicators reveals multiple red flags. The domain see-rabby-wallet.pages.dev, registered through Cloudflare, Inc. on September 02, 2020, resolves to the IP address 172.66.44.151, associated with Cloudflare's AS13335 in the United States. Security vendors on VirusTotal flag the domain at a detection rate of 11/95, indicating widespread recognition as malicious. Additionally, the domain appears on three distinct security blocklists and is actively blocked by multiple threat intelligence platforms. The SSL certificate, issued by Google Trust Services (WE1), further obscures the malicious intent by providing an appearance of legitimacy. Users who have visited see-rabby-wallet.pages.dev or interacted with its content should take immediate remedial actions. Disconnect all active wallet sessions and revoke any permissions granted to the domain or associated smart contracts. Conduct a full security audit of connected devices to detect potential malware or unauthorized access. Monitor all linked accounts, including cryptocurrency wallets and exchange platforms, for suspicious transactions. If credentials or private keys were entered, assume compromise and migrate assets to new, secure wallets. Report the domain to relevant security teams and blocklists to prevent further exploitation of other users.