rabyie-wallet-my[.]framer[.]ai

PhishDestroy has analyzed the domain rabyie-wallet-my.framer.ai and identified a serious brand impersonation threat targeting Rabby wallet users. This domain is currently offline, but its design and intent were clearly to deceive visitors into believing they were interacting with the legitimate Rabby platform. The threat type is brand impersonation, and the site specifically mimicked Rabby, a popular cryptocurrency wallet, likely to steal login credentials, private keys, or seed phrases.

Technical indicators paint a concerning picture. The domain was flagged by 5 out of 95 security vendors on VirusTotal, and it appears on 3 security blocklists. It was registered through CSC Corporate Domains, Inc. and resolves to IP address 35.71.142.77. The domain was created on January 6, 2018, giving it a long history that may have been intended to appear more legitimate. The SSL certificate was issued by Let's Encrypt, which provides basic encryption but does not verify the site's trustworthiness. The page title read "Site Not Found | Framer," suggesting the site was taken down or never fully functional.

Although the domain is currently offline, users should remain vigilant. If you interacted with this site or entered any sensitive information, immediately change your Rabby wallet passwords and enable two-factor authentication. Never trust unsolicited links or sites that ask for private keys or recovery phrases. Always verify the official URL of Rabby Wallet before logging in. PhishDestroy recommends using reputable security tools and staying informed about emerging phishing campaigns to protect your digital assets.