support-auth-rabbitx-trade[.]pages[.]dev

The domain support-auth-rabbitx-trade.pages.dev was registered on 2026-04-04 through Cloudflare, Inc. It resolves to the Cloudflare‑provided address 188.114.96.3, which is geolocated to Canada. The authoritative nameservers are carter.ns.cloudflare.com and elma.ns.cloudflare.com, and the site presents a valid Google Trust Services SSL certificate. HTTP requests return a 200 status and the page title reads “RabbitX Trade | Advanced Tools for Smart Crypto Traders”. Security telemetry classifies the site as a high‑risk brand‑impersonation campaign targeting the Rabby brand. PhishDestroy has already blocked the domain, yet it remains active as of the report date. VirusTotal analysis shows a single detection out of 94 scanning engines, and the domain appears on one external blocklist. Gridinsoft assigns a trust score of 0/100. The available evidence confirms the intent to misuse the Rabby brand, but the specific payload, credential‑harvesting mechanisms, or phishing page layout have not been publicly disclosed. Defenders should add the domain to firewall and DNS block lists, monitor for additional sub‑domains under the pages.dev namespace, and enforce strict outbound filtering for connections to Cloudflare‑originated IPs that were not previously authorized. Continuous re‑inspection of the site is advised, as the threat actor may modify content or introduce new malicious infrastructure.