11-cfm[.]pages[.]dev

This domain, 11-cfm.pages.dev, operates as an active crypto drainer specifically designed to impersonate the Rabby Wallet interface. Analysis indicates the site employs deceptive wallet connection prompts and transaction signing requests to execute unauthorized transfers of digital assets from victims' wallets. The infrastructure mimics legitimate wallet functionality while embedding malicious JavaScript that interacts with blockchain networks to drain funds upon user interaction, a tactic commonly associated with cryptocurrency theft operations. Infrastructure analysis reveals multiple high-risk indicators supporting this assessment. The domain was registered on August 10, 2025, through Cloudflare, Inc., and currently resolves to the IP address 188.114.97.3, associated with Cloudflare's network (AS13335). VirusTotal detection metrics show 2 out of 95 security vendors have flagged this domain, while it appears on one security blocklist. The SSL certificate, issued by Google Trust Services (WE1), provides encrypted connections that may lend false credibility to the malicious site. The page title explicitly displays 'Rabby Wallet,' further confirming the brand impersonation intent. Users who have visited 11-cfm.pages.dev or interacted with its content should immediately revoke any connected wallet permissions through their wallet provider's interface. All cryptocurrency transactions initiated through this domain should be considered compromised, and affected users should transfer remaining assets to a new wallet address using a clean device. Browser data, including cookies and cached files, should be cleared to eliminate any persistent session tokens. Security teams are advised to block the domain and associated IP address at the network level, while wallet providers should add this domain to their phishing detection systems to prevent further unauthorized access attempts.