rabvgc-djsggkf[.]pages[.]dev

Analysis of the domain rabvgc-djsggkf.pages.dev indicates active brand impersonation targeting Rabby, a cryptocurrency wallet service. The domain, registered on June 9, 2026, through Cloudflare Pages, resolves to the IP address 188.114.97.3. Infrastructure analysis reveals the use of Cloudflare hosting, Let's Encrypt SSL certification, and technologies including jQuery CDN, jQuery, HSTS, and HTTP/3. The page title explicitly presents itself as 'Rabby | Wallet,' aligning with the identified brand target. As of July 12, 2026, this domain appears on one security blocklist and is actively blocked by a single vendor. The Gridinsoft trust score for this domain is 0/100, reflecting a lack of established reputation. While the domain has been scanned by 95 vendors on VirusTotal, none currently flag it as malicious; however, the absence of detections does not confirm safety. The domain remains active, and its exact content or functionality has not yet been fully analyzed. Defenders are advised to monitor this domain for further indicators of compromise, particularly given its association with a cryptocurrency service. Organizations should consider implementing network-level blocks or alerts for this domain and its resolving IP address. Additional scrutiny of related infrastructure, such as domains registered through the same registrar or resolving to the same IP range, may be warranted to identify potential linked threats.