rubby-wallet-sso[.]pages[.]dev

On July 23, 2026 analysts observed that the subdomain rubby-wallet-sso.pages.dev was flagged as a high‑risk brand‑impersonation site targeting the Rabby cryptocurrency wallet. The domain was created on February 21, 2026 and is registered through Cloudflare, Inc., using the nameservers georgia.ns.cloudflare.com and sean.ns.cloudflare.com. Infrastructure analysis shows the domain resolves to the Cloudflare IP address 172.66.45.33, which is geolocated to Canada and serves content over HTTP/3 with HSTS enabled. The page title returned by the server is "Suspected phishing site | Cloudflare" and the HTTP response code is 403, indicating the site is currently inaccessible.

Google Safe Browsing classifies the URL as a social‑engineering threat, and VirusTotal reports that 13 of 93 security vendors have flagged the domain as malicious. The site appears on a single external blocklist and has been blocked by PhishDestroy. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment.

While the exact payload or credential‑harvesting mechanisms have not been publicly disclosed, the combination of brand impersonation, the Crypto Scam label, and multiple vendor detections suggests the domain was used to lure Rabby users into revealing private keys or signing malicious transactions. Defenders should add rubby-wallet-sso.pages.dev to deny‑list rules, monitor DNS queries for the associated Cloudflare nameservers, and enforce strict outbound filtering for traffic to Cloudflare‑hosted subdomains that are not explicitly authorized. Continuous threat‑intel feeds should be consulted for any re‑appearance of the domain or related indicators, and endpoint protection solutions should be updated to reflect the 13 vendor detections reported by VirusTotal.