rabyweb[.]pages[.]dev

PhishDestroy identifies rabyweb.pages.dev as an active crypto drainer impersonating financial brand portfolios under investigation for credential theft and fund misappropriation. This fraudulent domain leverages Cloudflare-registered infrastructure to redirect victims into malicious wallet-draining scripts via a generic phishing vector. No specific drainer kit (e.g., AngelDrainer, InfernoDrainer) has been publicly attributed yet, but behavioral patterns align with automated fund extraction from compromised wallets post-authentication. The site is designed to harvest private keys or seed phrases under the guise of portfolio verification, mirroring legitimate crypto dashboard interfaces to lower user suspicion. The campaign appears to target retail crypto investors seeking asset management tools or portfolio analytics.

Technical indicators confirm elevated risk potential: VirusTotal currently scores the domain at 2/95 detections across all scanners, indicating zero proactive blocking and high evasion capability. The domain resolves to IP 172.66.45.22 via Cloudflare’s infrastructure, which obscures origin while enabling rapid takedown evasion. Registration data remains obscured by Cloudflare’s privacy proxy, preventing WHOIS correlation. Global Safety Browsing (GSB) status is unverified due to low query volume, and no public blocklist entries (e.g., PhishTank, OpenPhish) currently list this domain—despite active user reports. Creation date and certificate issuance via Let’s Encrypt indicate opportunistic deployment, likely within the last 30 days. The lack of prior detection suggests this infrastructure may be part of a larger disposable domain cluster targeting emerging cryptocurrency trends.

This domain remains active as of assessment with a status labeled 'under_investigation' by domain safety analysts. Immediate response includes blocking IP 172.66.45.22 at network perimeter, flagging the domain for DNS sinkholing, and submitting to VirusTotal and GSB for rapid reprocessing. Users are advised to avoid interaction and report any encounter via browser safety tools. Remaining risk is classified as HIGH due to zero detection coverage and active payload delivery capability. The threat actor’s use of Cloudflare and Let’s Encrypt signifies operational sophistication aimed at evading traditional security layers. Continued monitoring is required to correlate with related infrastructure or drainer families. Organizations should deploy network-level countermeasures and update browser allowlists to preemptively block this domain.