bd6f3fdf[.]rabvgc-djsggkf[.]pages[.]dev

PhishDestroy identifies bd6f3fdf.rabvgc-djsggkf.pages.dev as an active brand impersonation domain currently masquerading as Rabby Wallet. This domain leverages a legitimate-looking subdomain structure under Cloudflare Pages to deceive users into revealing sensitive wallet credentials. The threat remains under investigation but has not yet been neutralized, maintaining active access to potential victims.

This domain was flagged by 1 of 95 VirusTotal vendors, indicating a lack of widespread detection despite its malicious intent. It resolves to IP address 188.114.96.3 and is registered through Cloudflare, Inc., leveraging Let's Encrypt for its SSL certificate to enhance credibility. The page title 'Rabby | Wallet' directly mirrors the legitimate Rabby Wallet branding to maximize deception. With no current blocklist entries and uncompromised trust scores from major security platforms, this domain remains a stealthy threat vector for cryptocurrency wallet users.

Users are strongly advised to avoid interacting with this domain or any pages linked to it. If credentials or sensitive data were entered, immediately revoke access via the official Rabby Wallet application and report the incident to Rabby's support channels. Enable multi-factor authentication (MFA) on all crypto wallets and verify URLs through official channels before any login attempts. Cloudflare's infrastructure for this domain should be scrutinized for additional malicious subdomains, and security teams are urged to flag IP 188.114.96.3 in network defenses. This domain serves as a reminder that even seemingly benign cloud services can host sophisticated impersonation campaigns targeting crypto users.