io-rabby-wallet[.]pages[.]dev

Analysis of the domain io-rabby-wallet.pages.dev, registered on November 8, 2025, reveals a high-risk phishing campaign targeting cryptocurrency users through brand impersonation. The domain, hosted on Cloudflare infrastructure, resolves to the IP address 172.66.47.156 (AS13335, United States) and is associated with nameservers bingo.ns.cloudflare.com and peter.ns.cloudflare.com. As of July 23, 2026, the domain returns an HTTP 403 status, indicating it is currently inaccessible, though it was previously flagged for social engineering by Google Safe Browsing. The page title, 'Rabby Wallet | Secure & Manage Your Crypto Effortlessly,' suggests an attempt to mimic legitimate wallet services, specifically targeting users of the Curve brand, as indicated by the 'brand target' classification.

The scam type is identified as wallet/seed phishing, a method used to harvest sensitive cryptocurrency credentials. Detection data from VirusTotal shows that 12 out of 95 security vendors have flagged this domain, while it appears on at least one security blocklist, including PhishDestroy. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious domains. Infrastructure analysis indicates the use of Cloudflare technologies, including HSTS and HTTP/3, which are often employed to enhance security and performance but can also obscure malicious activity.

The domain's trust score from Gridinsoft is 0/100, further supporting its classification as high-risk. While the exact content and mechanics of the phishing kit remain unconfirmed due to the domain's current offline status, the available evidence aligns with known patterns of crypto wallet impersonation. Defenders are advised to block the domain and its associated IP address (172.66.47.156) at the network level, monitor for related subdomains or newly registered lookalike domains, and alert users to the risk of seed phrase or private key theft.