greenrabbit[.]site

The domain greenrabbit.site was registered on 21 February 2026 through NiceNIC International Group Co., Limited and points to the Cloudflare address 104.21.58.123, advertised as belonging to ASN 13335 (Cloudflare, Inc.) located in the United States. The authoritative nameservers dolly.ns.cloudflare.com and nick.ns.cloudflare.com resolve the domain to the same IP, indicating the use of Cloudflare’s edge network for content delivery or proxying. No TLS certificate is presented; HTTPS connections terminate without an SSL layer, which is consistent with the observed HTTP 404 Not Found page title. The site is currently offline, and the HTTP response returns a generic 404 error rather than a brand‑specific login page.

The domain is flagged by two of ninety‑three VirusTotal scanners, and a Gridinsoft trust score of zero out of one hundred underscores a very low reputation. Independent blocklist services, including PhishDestroy, MetaMask, and SEAL, have added greenrabbit.site to their deny lists, and the domain appears on three additional security blocklists. The threat classification in the intelligence set identifies a crypto‑related scam that impersonates the brand “Rabby,” suggesting that the operator may have attempted to lure victims into a cryptocurrency transaction or credential harvest under the guise of the legitimate Rabby service. Evidence confirms the use of Cloudflare infrastructure, a lack of TLS, and a minimal detection footprint.

However, the exact malicious payload, phishing landing pages, or victim interaction flow have not been observed because the site returns a 404 status and is offline at the time of analysis. Consequently, the full scope of the campaign, including any associated command‑and‑control endpoints or payment addresses, remains uncertain. Defenders should continue to block greenrabbit.