rebby[.]com[.]mx

This domain rebby.com.mx is currently active and has been classified as a brand‑impersonation campaign targeting the Rabby brand. Registration was performed through Registrar.eu, and the authoritative name servers are ns1.openprovider.nl, ns2.openprovider.be, and ns3.openprovider.eu, indicating the use of the OpenProvider hosting platform. The site enforces HTTP Strict Transport Security (HSTS) and presents a TLS certificate issued by Let’s Encrypt (certificate type YR1), confirming that the connection is encrypted but does not mitigate the underlying abuse. When accessed, the HTTP response returns status code 403 and the page title displayed is “Attention Required! | Cloudflare”, suggesting that Cloudflare is being used as a front‑end protection layer, yet the underlying content remains undisclosed.

Infrastructure analysis shows the domain resolves to IP address 198.251.89.127, which is allocated to FranTech Solutions in Luxembourg. The same IP appears on three public security blocklists and has been flagged by PhishDestroy, MetaMask, and SEAL, indicating that multiple threat‑intelligence sources have already taken protective action. VirusTotal reports that 12 out of 91 scanning engines flag the domain, providing additional independent confirmation of malicious intent. AlienVault OTX lists the domain in two separate threat‑intel pulses, and the overall Gridinsoft trust score is 0 out of 100, reinforcing the high‑risk assessment.

Evidence points to a coordinated impersonation effort rather than an accidental misconfiguration. While the exact phishing landing page cannot be verified because the content behind the Cloudflare challenge is not publicly revealed, the combination of brand targeting, hostile infrastructure, multiple vendor detections, and blocklist listings provides a strong indication of fraudulent activity. Defenders should block rebby.com.