wletrbyef87d[.]yussufc3[.]workers[.]dev

This domain, wletrbyef87d.yussufc3.workers.dev, is actively impersonating the Metamask brand and poses a significant risk of brand impersonation. The website displays a page titled 'Rabby Wallet,' which is likely designed to deceive users into believing they are interacting with a legitimate Metamask service. The primary threat is that users may inadvertently provide sensitive information, such as login credentials or private keys, to what they believe is a secure and trusted platform. This could lead to financial loss, identity theft, and compromise of cryptocurrency wallets.

Analysis of the domain reveals that it is registered through Cloudflare, Inc., and was created on March 02, 2026. The domain resolves to the IP address 172.67.128.93, which is located in the United States and is part of the AS13335 Cloudflare, Inc. network. The SSL certificate for the domain is issued by Google Trust Services, which may lend it an appearance of legitimacy. According to VirusTotal, 5 out of 95 security vendors have flagged this domain as malicious, and it appears on 3 security blocklists, including PhishDestroy and SEAL.

If users have visited this domain, they should immediately check their Metamask accounts for any unauthorized activity. It is recommended to change passwords and enable two-factor authentication (2FA) if it is not already active. Users should also monitor their financial transactions and report any suspicious activity to their cryptocurrency exchange or wallet provider. Additionally, users should avoid clicking on links or downloading files from this domain and should report the incident to their security team or a trusted cybersecurity professional for further assistance.