rabbtixx-exchange[.]pages[.]dev

PhishDestroy identifies rabbtixx-exchange.pages.dev as an active crypto drainer posing as a cryptocurrency exchange. The domain, registered via Cloudflare, Inc., resolves to IP 188.114.96.3 and currently evades detection with 1 out of 95 VirusTotal engines flagging it. Its SSL certificate, issued by Google Trust Services, lends it a false air of legitimacy, making it a stealthy threat to crypto users.

This domain was flagged on seed 00d8a7 after analysis revealed its infrastructure aligns with known patterns used by crypto drainers. The absence of detections on VirusTotal (1/95 at the time of writing) highlights how quickly such threats can slip through automated defenses. Operators of rabbtixx-exchange.pages.dev likely exploit Cloudflare’s free hosting and Google’s SSL ecosystem to bypass early warning systems, targeting unsuspecting victims with fake exchange interfaces designed to drain digital assets.

If you’ve visited rabbtixx-exchange.pages.dev or entered any wallet credentials or transaction details, assume your assets are at risk. Disconnect from the internet immediately, transfer remaining funds to a newly generated wallet, and revoke any wallet approvals via tools like revoke.cash or Etherscan’s token approval tracker. Report the domain to PhishDestroy’s threat intelligence team and file a complaint with the relevant cybercrime authority (e.g., IC3 for U.S. users). Monitor your wallet activity closely for unauthorized transactions, as crypto drainers often operate with delayed withdrawal logic to maximize theft.