rbttxckawhouw9gdwdut[.]pages[.]dev

This domain was observed hosting a page titled “RabbitX”. DNS resolution points to the IP address 172.66.47.10, which belongs to Cloudflare’s AS13335 network located in the United States. The domain is registered through Cloudflare, Inc. and uses Cloudflare’s authoritative nameservers aurora.ns.cloudflare.com and benedict.ns.cloudflare.com. The site presented an HTTPS certificate issued by Let’s Encrypt (identifier E8), indicating that TLS was correctly configured before the takedown. HTTP requests now return a 403 status code, and the service has been taken offline at the time of analysis. Threat intelligence sources have flagged the domain as a generic phishing site.

VirusTotal records show that one out of ninety‑one scanning engines flagged the domain, and the domain appears on three external blocklists. Additional blocking services—PhishDestroy, MetaMask, and SEAL—have also listed the domain as malicious. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. The risk level is elevated, and the current operational status is offline. The available evidence confirms that the infrastructure is fully hosted on Cloudflare, which can obscure the true origin of the payload. No further details about the phishing payload, targeted brand, or credential‑capture mechanisms are publicly disclosed.

Consequently, the precise attack vector and victim profile remain uncertain. Defenders should immediately add 172.66.47.10 to network‑level deny lists and block any DNS resolution of rbttxckawhouw9gdwdut.pages.dev. Existing web‑filtering and email‑security solutions that reference the three blocklists, PhishDestroy, MetaMask, or SEAL should be updated to ensure the domain is denied. Continuous monitoring of Cloudflare‑associated IP ranges for similar patterns is recommended, as malicious actors frequently reuse the same hosting provider.