rabby-wallet-eng[.]pages[.]dev

The domain rabby-wallet-eng.pages.dev was registered on February 21, 2026 and is currently taken offline. Infrastructure analysis shows the domain resolves to the Cloudflare edge address 172.66.45.28, belonging to AS13335 Cloudflare, Inc., and is hosted in the United States. The authoritative name servers are meilani.ns.cloudflare.com and khalid.ns.cloudflare.com, both Cloudflare‑operated, indicating the domain was provisioned through Cloudflare, Inc. The site served a HTTP 403 response and presented the page title "Suspected phishing site | Cloudflare," confirming that Cloudflare’s protective page was triggered. TLS termination is performed by Google Trust Services using the WE1 certificate, and the site enforced HSTS while supporting HTTP/3, consistent with standard Cloudflare configurations.

Reputation services assign extremely low trust scores: Scamadviser rates the domain 1 out of 100 and Gridinsoft scores it 0 out of 100. The domain appears on a single security blocklist and is actively blocked by PhishDestroy. Google Safe Browsing flags the site for social engineering, and VirusTotal reports 12 out of 93 scanning engines flagging the domain as malicious, reinforcing the high‑risk assessment. The listed scam type is "Crypto Scam" and the domain explicitly impersonates the Rabby brand.

The available evidence strongly supports a brand‑impersonation threat targeting Rabby users, likely intended to harvest cryptocurrency credentials or lure victims into a malicious workflow. While the site is presently offline, the infrastructure—particularly the use of Cloudflare’s edge network and a Google‑issued certificate—could be rapidly re‑activated to host a replica phishing page. Defenders should therefore continue to block the domain at network perimeter controls, update threat‑intel feeds with the domain and associated indicators, and monitor for any re‑registration or resurrection attempts. Additional vigilance is advised for any traffic to the IP address 172.66.45.