support-rabby-io[.]pages[.]dev

On July 22, 2026 analysts observed that the domain support-rabby-io.pages.dev was created on February 21, 2026 and registered through Cloudflare, Inc. The domain resolves to the Cloudflare edge address 172.66.44.152, which is associated with AS13335 in the United States. TLS termination is provided by a Google Trust Services certificate issued to the WE1 organization, and the site employed HSTS and HTTP/3, indicating a modern Cloudflare configuration. When accessed prior to takedown, the site returned HTTP 403 and displayed the page title “Suspected phishing site | Cloudflare,” a generic warning page generated by Cloudflare for blocked content.

The infrastructure is explicitly listed as impersonating the Rabby brand and is categorized as a crypto scam. VirusTotal recorded five positive detections out of ninety‑three scanned security vendors, confirming malicious classification by multiple scanners. The domain appears on three external blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, while Gridinsoft assigned a trust score of zero out of one hundred, reflecting a high confidence of malicious intent.

Nameservers lloyd.ns.cloudflare.com and edna.ns.cloudflare.com further confirm the use of Cloudflare’s DNS services. The site is currently offline, but the combination of the malicious detections, blocklist listings, low trust score, and explicit brand impersonation suggests a continued risk to users who may receive links to the domain via phishing campaigns. Defenders should ensure that the domain is added to deny‑list rules across web filters, email gateways, and endpoint protection suites, monitor for any re‑registration attempts, and educate users about unsolicited communications referencing Rabby or cryptocurrency transactions that direct to this or similar Cloudflare‑hosted subdomains.