energywabbits[.]xyz

Analysis of energywabbits.xyz, registered on 22 February 2026 through NiceNIC International Group Co., Limited, shows it was used for a short‑lived phishing campaign that advertised an “Energy Wabbits NFT Giveaway”. The risk level for this host is assessed as elevated. The site resolved to the Cloudflare edge address 104.21.31.6, located in the United States under ASN 13335 (Cloudflare, Inc.). Both authoritative name servers—earl.ns.cloudflare.com and laura.ns.cloudflare.com—are Cloudflare‑provided, indicating the operator leveraged the platform’s CDN and DNS services.

No TLS certificate was presented, and the HTTP service is currently offline, confirming that the infrastructure has been taken down or otherwise disabled. VirusTotal scans recorded nine detections out of ninety‑five submitted security‑vendor signatures, and the domain appears on at least one public blocklist. PhishDestroy has also listed the host as malicious. The observed page title “Energy Wabbits NFT Giveaway” and the classification of the underlying code as an “Airdrop Scam” kit suggest the campaign attempted to lure victims with a cryptocurrency‑related giveaway, a common vector for credential‑stealing or wallet‑drain attacks.

Because the site is no longer reachable, content‑level verification is limited to the title and kit metadata; no additional artifacts such as login forms or malicious payloads have been captured. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑registration or reuse of the same IP address or Cloudflare name servers, and consider adding the host to internal threat‑intel feeds. Continuous observation of Cloudflare‑hosted IP ranges for similar kit signatures is recommended, as the attacker may migrate to new subdomains or exploit the same CDN infrastructure for future campaigns.