raaby-walet-acces[.]pages[.]dev

The domain raaby-walet-acces.pages.dev was created on February 21, 2026 and registered through Cloudflare, Inc. DNS resolution points to IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The hosting infrastructure employs Cloudflare services, including HTTP/3 and HTTP Strict Transport Security, and presents a Google Trust Services / WE1 SSL certificate. An HTTP request to the host returns a 403 status code, and the only page title observed is "Suspected phishing site | Cloudflare". Intelligence categorises the activity as credential phishing, and ten of ninety‑three VirusTotal scanners have flagged the domain as malicious.

Google Safe Browsing also marks the site for social‑engineering risk. Additional reputation data shows a Gridinsoft trust score of zero out of one hundred, the domain appears on a single security blocklist, and PhishDestroy has actively blocked it. Nameservers tess.ns.cloudflare.com and fonzie.ns.cloudflare.com are in use, confirming the Cloudflare registration. The current operational state is offline, limiting immediate access to any payload.

No detailed content, landing page screenshots, or targeted brand information have been captured, leaving the specific credential collection method and victim profile uncertain. Defenders should proactively block raaby-walet-acces.pages.dev at DNS or proxy layers, add the associated IP 188.114.96.3 to relevant threat‑intel feeds, and monitor outbound connections for any attempts to reach the domain or its infrastructure. Continuous re‑evaluation is advised in case the host returns to service or new indicators emerge.