rabbywallets-9lg[.]pages[.]dev

This domain, rabbywallets-9lg.pages.dev, is flagged as a brand impersonation threat targeting users of the Rabby Wallet, a cryptocurrency wallet for Ethereum and EVM-compatible networks. Analysis indicates the site mimics the legitimate Rabby Wallet interface, presenting a page titled 'Rabby Wallet | Your Go-to Wallet for Ethereum and EVM,' a common tactic to deceive users into interacting with fraudulent smart contracts or disclosing private keys. The domain does not appear to be linked to a known drainer kit at this time, but its structure and content align with typical crypto wallet impersonation schemes designed to facilitate unauthorized fund transfers. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., and resolves to the IP address 188.114.97.3. The domain was created on March 14, 2026, though this date may reflect a misconfiguration or deliberate obfuscation. Detection metrics indicate a VirusTotal score of 3/95 security vendors, with detections from MetaMask, PhishDestroy, and SEAL. The domain appears on three security blocklists and has a Gridinsoft trust score of 0/100. Technologies detected on the site include jsDelivr, HSTS, Cloudflare, and HTTP/3, with a Let's Encrypt SSL certificate providing HTTPS encryption, a common feature in phishing sites to appear legitimate. As of the latest assessment, rabbywallets-9lg.pages.dev has been taken offline, likely due to enforcement actions by the hosting provider or security entities. However, the elevated risk remains due to the domain's prior activity and the potential for reemergence under a similar or altered infrastructure. Users who interacted with this domain should immediately revoke any connected smart contract approvals, check wallet addresses for unauthorized transactions, and monitor for further impersonation attempts. The use of hardware wallets and multi-factor authentication for sensitive transactions is strongly advised to mitigate similar threats.