download-rbby-wallet-en-cdn[.]pages[.]dev

The domain download-rbby-wallet-en-cdn.pages.dev was registered on 2025-10-14 through Cloudflare, Inc. and resolves to the Cloudflare IP address 172.66.47.146 located in Canada. It is served over HTTPS with a certificate issued by Google Trust Services (WE1) and returns HTTP 200 for the root request. The page title observed is "Rabby Wallet Download | Manage Your Crypto with Confidence," indicating a brand‑impersonation campaign aimed at users of the Rabby cryptocurrency wallet. Infrastructure analysis shows the domain uses the Cloudflare nameservers keyla.ns.cloudflare.com and randy.ns.cloudflare.com, and it currently carries a Gridinsoft trust score of 0/100, suggesting a high likelihood of malicious intent. The domain is listed on a single security blocklist and has been blocked by the PhishDestroy service, confirming active mitigation by at least one sink‑hole. VirusTotal reports that the site was scanned by 91 vendors without any detections, but the absence of a detection does not constitute a safety assurance. The domain remains active as of the report date. Defenders should add the domain to outbound filtering rules, monitor DNS queries for the associated IP range, and educate Rabby wallet users about unsolicited download prompts. Continuous observation is advised to detect any changes in hosting or content that could increase the threat posture.