rabby-wallet-io[.]pages[.]dev

This domain, rabby-wallet-io.pages.dev, is actively engaged in brand impersonation targeting Across, a known decentralized finance protocol. Analysis indicates the site is designed to deceive users into believing it is the legitimate Rabby Wallet, a popular Ethereum and EVM-compatible wallet interface. The domain currently remains operational and poses a high-risk threat due to its convincing mimicry of trusted crypto infrastructure. Infrastructure analysis reveals the domain was registered on October 9, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.47.150, hosted on Cloudflare’s network (AS13335). The SSL certificate is issued by Google Trust Services under the WE1 root, a common configuration for legitimate services but frequently abused in phishing operations. The domain is flagged by 12 of 95 security vendors on VirusTotal, appears on one security blocklist, and is explicitly labeled as phishing by Google Safe Browsing. The page title, 'Rabby Wallet | #1 Rated Wallet for Ethereum and EVM Chains,' directly mirrors the branding of the authentic Rabby Wallet, increasing the likelihood of successful deception. Current status confirms the domain remains active and accessible, with no evidence of takedown or mitigation. Users and organizations are strongly advised to block the domain at the network level, particularly in environments handling cryptocurrency transactions. Security teams should monitor for credential submissions or wallet connection attempts to this domain, as these are likely indicators of compromise. Immediate reporting to registrar abuse contacts and relevant threat intelligence platforms is recommended to expedite remediation.