rabbitswap[.]org

Analysis indicates that the domain rabbitswap.org was registered on September 1, 2025 through NameSilo, LLC. The authoritative nameservers are nina.ns.cloudflare.com and walt.ns.cloudflare.com, pointing the domain to the IP address 172.217.18.4, which belongs to AS15169 Google LLC and is geolocated in the United States. The lack of an SSL/TLS certificate means the site operated without HTTPS. The page title returned by the server is “Google”, matching the declared brand target of Google and confirming a brand‑impersonation intent. The site is identified as a crypto‑scam, although the exact malicious payload or transaction flow has not been observed.

VirusTotal submitted the domain to 95 scanners and recorded a single positive detection, indicating that at least one security vendor flagged the domain as malicious. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. Multiple independent blocklists—including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura—have listed the domain, and overall it appears on five security blocklists. The current operational status is offline, which prevents further live interaction but does not eliminate the risk from cached or previously distributed content.

Defenders should continue to block the domain at the DNS and proxy level, monitor for any residual references in email or messaging traffic, and consider adding the domain to internal threat intelligence feeds. Additional investigation is warranted to determine whether any phishing kits or malicious payloads were ever served before takedown, and to verify whether the IP address has been reused for unrelated legitimate services. Until such verification is complete, the domain should be treated as a confirmed malicious infrastructure targeting users of Google services through a crypto‑scam façade.