wallet-rabby-in[.]pages[.]dev

The domain wallet-rabby-in.pages.dev is currently active and exhibits characteristics of a high-risk brand impersonation campaign targeting users of the Across protocol. Analysis indicates this site is designed to mimic the legitimate Rabby Wallet interface, a multi-chain DeFi gateway, as evidenced by its page title: 'Rabby Wallet: Modern Multi-Chain DeFi Gateway – Features, Security, and UX.' This impersonation tactic is commonly employed to deceive users into entering sensitive credentials or approving malicious transactions, leading to unauthorized access or asset theft. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on September 02, 2020, and currently resolves to the IP address 172.66.47.73, geolocated to the United States under AS13335 (Cloudflare, Inc.). Detection metrics show the domain is flagged by 3 of 95 security vendors on VirusTotal, indicating moderate but concerning detection coverage. Additionally, it appears on three independent security blocklists and is actively blocked by at least three major security frameworks, including PhishDestroy and MetaMask’s built-in protections. The SSL certificate is issued by Google Trust Services (WE1), which does not mitigate the underlying malicious intent. The domain remains operational as of this analysis, posing an ongoing threat to users interacting with DeFi platforms. Security teams and end-users are advised to treat wallet-rabby-in.pages.dev as malicious and avoid all interaction. Network-level blocking of the IP 172.66.47.73 and domain-based filtering are recommended for organizations. Users who may have engaged with this domain should revoke any connected wallet permissions, rotate credentials, and monitor accounts for unauthorized activity. Continuous monitoring of related infrastructure, particularly subdomains under pages.dev, is advised to detect further iterations of this campaign.