en-rabbywallet[.]framer[.]ai

This domain carries a high risk level due to its clear brand impersonation of Rabby Wallet, a popular Ethereum and multi-chain wallet. The site was designed to trick users into believing they were accessing the legitimate Rabby Wallet interface, likely to steal login credentials or seed phrases. The threat is specifically a fake login page, a common tactic for crypto drainers.

Multiple indicators confirm the malicious nature of en-rabbywallet.framer.ai. VirusTotal flagged it with 7 out of 95 security vendors marking it as malicious. The domain was created on April 4, 2023, and registered through CSC Corporate Domains, Inc. It resolves to IP address 52.223.52.2 and uses a Let's Encrypt SSL certificate (E8). Google Safe Browsing flags it as phishing, and it appears on 3 security blocklists. The page title was '@Rabby Wallet | Your Go-to Wallet for Ethereum and*', further confirming the impersonation. Fortunately, the domain has been taken offline.

To stay safe, users should always verify the official Rabby Wallet URL and never enter private keys or seed phrases on any site accessed via links from emails, social media, or search ads. PhishDestroy recommends bookmarking the official website and enabling two-factor authentication where possible. If you have already interacted with this domain, immediately transfer funds to a new wallet and revoke any token approvals.