wallet-raabby-us[.]pages[.]dev

Analysis indicates that the domain wallet-raabby-us.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. The domain resolves to the Cloudflare edge IP 172.66.47.116, located in the United States and announced as part of ASN 13335 (Cloudflare). The TLS certificate presented is issued by Google Trust Services under the WE1 root, confirming a valid HTTPS connection with HSTS enabled and HTTP/3 support. The site returned HTTP 403, and the current status is offline; the domain has been taken down and is listed as blocked by PhishDestroy. Infrastructure signals show the domain is served by Cloudflare nameservers sneh.ns.cloudflare.com and leonard.ns.cloudflare.com.

A Gridinsoft trust score of 0 / 100 further reflects a malicious classification. The page title observed in prior crawls, “Rabby ® Wallet — Guide, Troubleshooting & FAQs,” together with the recorded scam type “Wallet/Seed Phishing” and the “impersonates: ethereum” tag, indicate a targeted attempt to harvest cryptocurrency wallet credentials or seed phrases by masquerading as the Rabby wallet ecosystem. Google Safe Browsing flags the domain for social engineering, and VirusTotal recorded detections by seven of ninety‑three security vendors, confirming a consensus of malicious intent. The domain appears on a single security blocklist, reinforcing its reputation as a threat vector.

Uncertainty remains around the exact content served before takedown, as no visual or functional analysis is available. Defenders should immediately block the domain at DNS and proxy layers, add the associated IP address to network‑level deny lists, and monitor for newly registered subdomains under the pages.dev namespace that reference “Rabby” or “Ethereum.” Security awareness training should emphasize that legitimate Rabby wallet communications originate from official Rabby domains and never request seed phrases via unsolicited links.