lern-rabby-walet-extnson[.]pages[.]dev

On 23 July 2026 the domain lern-rabby-walet-extnson.pages.dev was observed serving a page titled “Suspected phishing site | Cloudflare”. The site was registered through Cloudflare, Inc. on 21 February 2026 and is hosted on Cloudflare’s network (AS13335) with the IP address 172.66.44.243 located in the United States. TLS termination is performed by a Google Trust Services certificate (WE1) and the server advertises HSTS and HTTP/3. An HTTP 403 response was returned at the time of analysis, and the domain has since been taken offline.

VirusTotal records indicate that 10 of 95 scanned security vendors flagged the domain as malicious. Independent blocklists including PhishDestroy, MetaMask and SEAL have listed the domain, and it appears on three additional security blocklists. Gridinsoft assigned a trust score of 0 out of 100. The page title and the brand target “Rabby” suggest a crypto‑related brand impersonation campaign, and the intelligence classifies the activity as a “Crypto Scam”.

Nameservers are elly.ns.cloudflare.com and devin.ns.cloudflare.com. No further content analysis is available beyond the page title. Defenders should continue to block the domain at network perimeters, update endpoint and browser protection signatures to include the observed identifiers, and monitor for any re‑registration of similar subdomains within the Cloudflare namespace. Ongoing vigilance is recommended given the high risk rating and the active exploitation of Cloudflare‑hosted assets for brand‑impersonation attacks.