info-rabby-walet-extension[.]pages[.]dev

This domain, info-rabby-walet-extension.pages.dev, poses a high-risk brand impersonation threat targeting users of the Rabby wallet service. The site mimics legitimate Rabby interfaces to deceive visitors into disclosing sensitive credentials, such as private keys or recovery phrases, which attackers can then exploit to gain unauthorized access to cryptocurrency wallets. The fraudulent nature of this operation is evident through its deceptive design, intended to replicate the appearance and functionality of the authentic Rabby platform, thereby increasing the likelihood of successful credential harvesting. Analysis indicates this domain was registered on September 02, 2020, through Cloudflare, Inc., and is currently flagged by 11 out of 95 security vendors on VirusTotal. Infrastructure review reveals the domain resolves to the IP address 172.66.44.186, hosted on Cloudflare’s network (AS13335). The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the malicious intent, as the site has been confirmed as phishing by Google Safe Browsing and appears on three security blocklists. The page title, 'Suspected phishing site | Cloudflare,' further corroborates its fraudulent classification. Users who visited info-rabby-walet-extension.pages.dev should immediately cease all interaction and revoke any permissions granted to the site within their wallet applications. If credentials or recovery phrases were entered, the affected wallet must be considered compromised. Transfer remaining assets to a new, secure wallet using a trusted device, and monitor all linked accounts for unauthorized transactions. Enable multi-factor authentication where available and report the incident to relevant security teams for further mitigation. Regularly update security software to detect and block similar threats.