wallet-rabby-en-us[.]pages[.]dev

Analysis of the domain wallet-rabby-en-us.pages.dev indicates a high-risk phishing campaign targeting users of the Rabby cryptocurrency wallet. The domain, registered on February 21, 2026, through Cloudflare, Inc., resolves to the IP address 172.66.44.78, hosted on Cloudflare's infrastructure (AS13335) in the United States. At the time of assessment, the domain returned an HTTP 403 status, with Cloudflare serving a page titled 'Suspected phishing site,' a designation consistent with its internal security mechanisms. Google Safe Browsing has flagged the domain for social engineering, while PhishDestroy has explicitly blocked it. Detection data from VirusTotal reveals that 12 out of 93 security vendors classify this domain as malicious, further corroborating its phishing classification.

Infrastructure analysis reveals the use of Cloudflare nameservers (novalee.ns.cloudflare.com and rustam.ns.cloudflare.com) and technologies such as HSTS and HTTP/3, which are commonly employed to enhance security but may also be leveraged by threat actors to obfuscate malicious activity. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider, which does not mitigate the domain's malicious intent. Gridinsoft assigns a trust score of 0/100, reinforcing its high-risk status. The domain appears on at least one security blocklist, though additional blocklist data may exist beyond the scope of this report.

The exact content of the phishing page is not yet analysed, but the scam type is classified as a crypto scam, aligning with the impersonation of Rabby, a known cryptocurrency wallet service. Defenders are advised to treat this domain as malicious and prioritise blocking it at the network and endpoint levels. Organisations should monitor for any residual connections to 172.66.44.78 and review logs for interactions with the domain, particularly in environments where Rabby or similar crypto wallets are used.