rabbitswap[.]io

The domain rabbitswap.io was registered through NiceNIC International Group Co., Limited on February 21 2026. It resolves to the Cloudflare IP address 188.114.96.3 (AS13335, United States) and uses Cloudflare’s DNS (jack.ns.cloudflare.com, meera.ns.cloudflare.com). The site presents a TLS certificate from Let’s Encrypt (E8) and returns HTTP 403 with the page title “Just a moment…”, which is typical of a Cloudflare challenge page. Infrastructure analysis shows a Node.js stack with Express, HSTS enabled, Cloudflare Browser Insights and HTTP/3 support, indicating a modern web server behind Cloudflare’s reverse‑proxy.

The domain is listed on seven security blocklists and is actively blocked by PhishDestroy, MetaMask, ScamSniffer, Polkadot, and SEAL. VirusTotal reports six detections out of ninety‑three scanned engines, and Gridinsoft assigns a trust score of 0 / 100, confirming a very low reputation. Intelligence tags the site as an “Airdrop Scam” and classifies the activity as a crypto‑scam that impersonates the Rabby brand. These indicators collectively place the domain in the high‑risk category for brand impersonation.

What remains uncertain is the exact content served after the Cloudflare challenge; the 403 response may be a protective block rather than the final malicious payload. Defenders should therefore block any network traffic to rabbitswap.io, add the domain to URL filtering and email security policies, and monitor DNS queries for the associated IP address. Users of the Rabby wallet should be warned not to visit the site or provide credentials. Ongoing re‑assessment with VirusTotal and other AV vendors is recommended to track changes in detection status.