rabbyie[.]pages[.]dev

Analysis of the domain rabbyie.pages.dev indicates active brand impersonation targeting Across, a known cryptocurrency platform. The domain, registered on November 27, 2025, through Cloudflare, Inc., currently resolves to IP address 172.66.44.78. Infrastructure analysis reveals the use of Cloudflare hosting, jsDelivr for content delivery, and HTTP/3 with HSTS enforcement. The SSL certificate is issued by Google Trust Services, a common practice among both legitimate and malicious sites. The page title, 'Rabby Wallet | Your Go-to Wallet for Ethereum and EVM,' suggests an attempt to mimic Rabby Wallet, a legitimate wallet service, though the exact content and functionality of the site remain unconfirmed. Security vendors have flagged this domain, with 3 out of 95 detecting it as malicious. It appears on three security blocklists and is actively blocked by SEAL, MetaMask, and PhishDestroy. The domain's Gridinsoft trust score of 0/100 further supports its classification as high-risk. While the domain's creation date is recent, it falls within expected timeframes for phishing infrastructure. Defenders should treat this domain as active and malicious, particularly in environments involving cryptocurrency transactions or wallet interactions. No evidence currently links this domain to a specific phishing kit or campaign beyond the observed brand impersonation. Further analysis of the site's content and backend infrastructure may provide additional context, but the existing indicators justify immediate blocking and monitoring.