rabby-open-source[.]pages[.]dev

The domain rabby-open-source.pages.dev has been identified as a brand impersonation threat targeting the Rabby crypto wallet platform. Currently under active investigation, this domain mimics Rabby's official branding with a page titled 'Rabby - Open Source Platform' to deceive users into believing it is legitimate. The domain was created on September 11, 2025, and remains active, posing an ongoing risk to cryptocurrency users who may unknowingly expose sensitive information or connect their wallets.

Technical analysis reveals that rabby-open-source.pages.dev is registered through Cloudflare, Inc. and resolves to IP address 172.66.46.227. It uses an SSL certificate issued by Google Trust Services / WE1, which is common for fraudulent sites to appear secure. Despite being flagged by one security blocklist, VirusTotal shows 0 out of 95 detections, meaning no antivirus engines have yet marked it as malicious. This low detection rate is typical for newly deployed phishing domains, as they often evade initial scans. The domain's registration through Cloudflare may also help it avoid rapid takedown.

Given its active status and the high value of crypto wallet credentials, users are strongly advised to avoid interacting with rabby-open-source.pages.dev. PhishDestroy recommends verifying any site claiming to be Rabby by navigating directly to the official domain. If you have already visited this domain, do not enter any private keys or seed phrases and consider revoking any wallet permissions granted. Stay vigilant against brand impersonation scams, especially those promising open-source platforms or airdrops.