rabbyy[.]pages[.]dev

This domain, rabbyy.pages.dev, poses a high-risk brand impersonation threat targeting users of the Across protocol, a cross-chain bridging platform. The site mimics the legitimate Rabby Wallet interface, presenting itself as a go-to wallet for Ethereum and EVM-compatible networks. Users who interact with this domain risk exposing sensitive credentials, private keys, or seed phrases, which could lead to unauthorized access to cryptocurrency wallets and financial theft. The site may also distribute malicious payloads or redirect users to fraudulent smart contracts designed to drain funds. Analysis indicates this domain was registered on November 26, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.44.63, hosted on Cloudflare’s infrastructure (AS13335). Security vendors on VirusTotal have flagged this domain, with 3 out of 95 engines detecting malicious activity. The domain appears on three security blocklists, including those maintained by reputable threat intelligence providers. The SSL certificate, issued under the WE1 root, does not mitigate the risk, as fraudulent domains frequently leverage valid certificates to appear legitimate. If a user has visited rabbyy.pages.dev or interacted with its content, immediate action is required. First, disconnect any connected wallets or dApps associated with the domain. Revoke any permissions granted to smart contracts or applications linked to the site using a blockchain explorer or wallet management tool. Scan the device for malware using updated security software, as the domain may have delivered malicious payloads. Monitor wallet activity for unauthorized transactions and consider transferring assets to a new, secure wallet if compromise is suspected. Report the domain to relevant threat intelligence platforms to aid in broader mitigation efforts.