updated-rabby-wallet[.]pages[.]dev

The domain updated-rabby-wallet.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the IP address 172.66.46.236, which belongs to AS13335 Cloudflare in the United States. The site presents the page title "Rabby Wallet: Features, Setup, Troubleshooting & FAQs", directly targeting the Rabby brand and is classified as a crypto‑related scam. Technical analysis shows the domain is served behind Cloudflare with HTTP/3 enabled and enforces HSTS, while the SSL certificate is issued by Google Trust Services (WE1). An HTTP 403 response is returned, and the domain is currently taken offline.

Reputation data indicates a Gridinsoft trust score of 0 out of 100, confirming extremely low trust. The domain appears on three security blocklists and has been flagged by PhishDestroy, MetaMask, and SEAL, reinforcing the malicious classification. Google Safe Browsing lists the site under social engineering, and VirusTotal reports that 14 of 93 scanners label the domain as malicious. The combination of brand impersonation, cryptographic scam labeling, low trust score, multiple blocklist entries, and active detection by major security vendors suggests a high‑risk profile.

Uncertainties remain regarding the exact payload or phishing page content, as the site is not publicly reachable and no further forensic artifacts have been disclosed. Defensive actions should include adding the domain to deny‑list rules, monitoring for any resurrection of the host, and ensuring that endpoint protection solutions that reference Google Safe Browsing, VirusTotal, or the cited blocklists are up‑to‑date. Organizations using Rabby wallet services should warn users about the impersonation attempt and educate them to verify official URLs before entering credentials or cryptocurrency information.