home-rubby-wallet[.]pages[.]dev

On 23 July 2026 analysts observed the domain home-rubby-wallet.pages.dev serving a malicious page that advertises a “Rabby Wallet: Secure, Fast, and User‑Friendly Crypto Asset Manager”. The page title is explicitly recorded, and the domain is registered through Cloudflare, Inc., with creation timestamp 22 October 2025. Infrastructure analysis shows the domain resolves to IP 188.114.97.3, which belongs to AS13335 Cloudflare, Inc., and is geolocated in the United States. The site presented an HTTP 403 response at the time of collection and employed security mechanisms such as HSTS, HTTP/3, and a TLS certificate issued by Google Trust Services (Common Name WE1). Defensive feeds indicate the domain has been added to a single security blocklist and is blocked by the PhishDestroy service.

Google Safe Browsing classifies the site as social engineering, and VirusTotal records 15 detections out of 95 scanners, reflecting a high confidence of malicious intent. The Gridinsoft trust score of 0 / 100 further corroborates its malicious nature. Nameserver configuration includes hans.ns.cloudflare.com, magnolia.ns.cloudflare.com, ns.cloudflare.com, and ns2.cloudflare.com. The campaign is identified as a wallet/seed phishing operation that impersonates the Binance brand, aiming to harvest private keys or seed phrases from cryptocurrency users.

Current status shows the site is offline, but the observed infrastructure may be reused in future campaigns. Uncertainties remain regarding the exact phishing kit or credential harvesting mechanism, as the page content beyond the title has not been publicly disclosed. Defenders should block the domain and its associated IP address at perimeter devices, update URL filtering and threat‑intel feeds with the observed indicators, monitor for similar sub‑domains under the pages.dev namespace, and enforce strict validation of Binance‑related communications to mitigate credential theft.