en-rabby-wallet[.]pages[.]dev

The domain en-rabby-wallet.pages.dev is a confirmed phishing site engaged in brand impersonation targeting the cryptocurrency platform 'across'. It presents itself as a Rabby Wallet landing page but is designed to deceive users into disclosing sensitive information or transferring funds under false pretenses. This site does not employ a known drainer kit but operates as a cryptocurrency scam. As of the latest verification, en-rabby-wallet.pages.dev has been taken offline.

Technical analysis reveals that en-rabby-wallet.pages.dev was flagged by 2 of 95 security vendors on VirusTotal, including Phishing Database and Trustwave. The domain is registered through Cloudflare, Inc., with a creation date of February 26, 2026, and resolves to the IP address 188.114.96.3, hosted on Cloudflare's infrastructure in the US. It appears on 3 security blocklists, including PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Google Trust Services (WE1), and the observed page title was 'Rabby Wallet | Landing Page'. Technologies detected include HSTS, Cloudflare, and HTTP/3, with a current HTTP status of 403 indicating restricted access.

Users who interacted with en-rabby-wallet.pages.dev should immediately revoke any token approvals granted to unknown contracts and transfer remaining funds to a new, secure wallet. If credentials were entered, change passwords for all associated accounts and enable two-factor authentication. Report the phishing domain to the impersonated brand's security team (Across) and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in broader mitigation efforts.