rabbywllet[.]pages[.]dev

On July 24, 2026 analysts observed the domain rabbywllet.pages.dev returning HTTP 403 and currently marked offline. The site advertised itself with the page title “Rabby Wallet — Secure Multi-Chain Crypto Wallet,” indicating a focus on cryptocurrency wallet services. Registration records show the domain was created on February 21, 2026 through Cloudflare, Inc., and it resolves to the IP address 172.66.47.100, which belongs to AS13335 Cloudflare in the United States. DNS resolution is handled by the Cloudflare nameservers brett.ns.cloudflare.com and katelyn.ns.cloudflare.com, and the TLS certificate is issued by Google Trust Services under the WE1 root, confirming the use of a legitimate certificate chain. Multiple security controls have flagged the domain.

Google Safe Browsing categorises it as a social engineering threat, and VirusTotal reports nine out of ninety‑three scanning engines as malicious, reinforcing the suspicion of malicious intent. The site appears on one security blocklist and has been actively blocked by PhishDestroy. Additional telemetry shows a Gridinsoft trust score of 0 out of 100, and the presence of HSTS, Cloudflare CDN, and HTTP/3 indicates a modern web stack. The threat profile aligns with a wallet/seed phishing campaign that impersonates the “across” brand, as indicated by the “Impersonates: across” tag.

No visual or functional analysis of the page content is available because the site is offline, leaving the exact phishing vectors (e.g., credential‑stealing forms or seed phrase collection) unverified. Defenders should treat the domain as malicious, add it to network and endpoint blocklists, and monitor related Cloudflare‑hosted subdomains for similar naming patterns. Users should be warned that any unsolicited request to install or interact with a “Rabby Wallet” client originating from this domain is likely fraudulent.