1xv[.]pages[.]dev

This domain, 1xv.pages.dev, poses as the legitimate Rabby Wallet interface to deceive users into entering sensitive credentials or wallet recovery phrases. Analysis indicates the site is designed to harvest login details, enabling unauthorized access to cryptocurrency wallets and potential asset theft. The page title explicitly mimics the official Rabby Wallet, increasing the likelihood of successful deception among users familiar with the brand. Infrastructure analysis reveals the domain was registered on August 09, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.47.101. It is flagged by 1 out of 95 security vendors on VirusTotal, with detections from MetaMask, PhishDestroy, and SEAL blocklists. The domain appears on three security blocklists, and its SSL certificate is issued by Google Trust Services. Technologies detected include HSTS and HTTP/3, suggesting an attempt to appear legitimate while obfuscating malicious intent. Users who visited 1xv.pages.dev should immediately revoke any permissions granted to the site in their wallet applications. Reset passwords and recovery phrases for any accounts or wallets accessed during the visit. Monitor connected wallets for unauthorized transactions and enable multi-factor authentication where available. If credentials were entered, assume compromise and transfer assets to a new, secure wallet. Report the incident to relevant security teams or platforms to aid in broader mitigation efforts.