get-extension-rabby-wallet[.]pages[.]dev

This domain, get-extension-rabby-wallet.pages.dev, was registered on February 21 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 172.66.45.28, hosted in the United States under ASN 13335. The site served an HTTP 403 response and presented the page title “Suspected phishing site | Cloudflare”, indicating that Cloudflare’s mitigation system identified it as malicious. TLS termination is performed by a Google Trust Services certificate issued to the WE1 authority, and the connection employed HSTS and HTTP/3, consistent with typical Cloudflare‑provided services.

The domain is listed on a single security blocklist and has been blocked by the PhishDestroy sinkhole, after which the site was taken offline. VirusTotal recorded a single positive detection out of ninety‑five scanners, and Google Safe Browsing classified the URL as a social‑engineering threat. Gridinsoft assigned a trust score of 0 / 100, reinforcing the low credibility assessment.

The page title and the “Crypto Scam” classification suggest a cryptocurrency‑related impersonation campaign targeting the brand “across”, although no further page content has been disclosed. Defenders should continue to deny DNS resolution for the domain, enforce outbound filtering of the IP 172.66.45.28, and monitor for any resurgence of similarly structured subdomains under the pages.dev namespace. Existing security tools that reference Google Safe Browsing or VirusTotal should be updated to flag this indicator, and incident response teams should treat any credential or wallet information submitted to this URL as compromised.