wltraby-23r-3r4[.]melida[.]workers[.]dev

The domain wltraby-23r-3r4.melida.workers.dev was observed hosting a page titled "Rabby Wallet" and is classified as a wallet/seed phishing site that impersonates the Rabby brand. The site was registered through Cloudflare, Inc., and the TLS certificate is issued by Google Trust Services under the WE1 label, indicating a legitimate‑looking HTTPS endpoint. Network analysis shows the domain resolves to IP address 104.21.85.23, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. HTTP probing returned a 403 status code, and the server presents HSTS, Cloudflare, and HTTP/3 headers, consistent with the underlying Cloudflare infrastructure.

VirusTotal scans flagged the domain in 13 of 95 security engines, reinforcing the malicious assessment. The domain received a Gridinsoft trust score of 0 / 100 and appears on one external security blocklist. It has been blocked by the PhishDestroy service and is currently listed as offline. Nameserver data could not be retrieved (NS_NOT_FOUND).

While the technical fingerprint confirms the use of reputable hosting services to mask malicious intent, the presence of a Rabby‑related page title and the explicit wallet/seed phishing classification provide strong evidence of brand impersonation targeting cryptocurrency users. Defenders should continue to block the domain at network perimeter filters, monitor for any re‑registration attempts, and advise users to verify URLs before entering wallet credentials. Threat intelligence feeds should be updated with the domain’s indicator set, including the IP address, SSL certificate details, and the 13 VirusTotal detections, to improve detection across security products.