home-wallet-rabby-x[.]pages[.]dev

Analysis of the domain home-wallet-rabby-x.pages.dev indicates active brand impersonation targeting Aave, a decentralized finance protocol, under the guise of Rabby Wallet, a multichain browser wallet. The domain, registered on November 8, 2025, through Cloudflare, Inc., resolves to the IP address 172.66.46.224, associated with AS13335 (Cloudflare, Inc.) and located in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (sue.ns.cloudflare.com and bob.ns.cloudflare.com), alongside technologies such as HSTS and HTTP/3, which are consistent with modern web hosting practices but do not preclude malicious use. The domain is flagged by 17 of 95 security vendors on VirusTotal, and Google Safe Browsing has classified it under SOCIAL_ENGINEERING, corroborating its high-risk status. Additional assessments, including a Gridinsoft trust score of 0/100 and a Scamadviser trust score of 1/100, further support its classification as malicious. The domain appears on at least one security blocklist and is explicitly blocked by PhishDestroy. The page title, 'Rabby Wallet | Secure Multichain Browser Wallet,' aligns with the impersonation of a legitimate cryptocurrency wallet service, though the exact content and functionality of the site remain unanalyzed. Defenders should prioritize blocking this domain at the DNS and network levels, given its active status and confirmed association with cryptocurrency-related fraud. The use of Cloudflare hosting and SSL certification (issued by Google Trust Services) does not mitigate the threat, as these are commonly leveraged by malicious actors to lend credibility. No evidence suggests this domain is part of a broader campaign, but its registration age and ongoing activity warrant continued monitoring for related infrastructure.