rabbywallet-x-sso--connect[.]framer[.]media

The domain rabbywallet-x-sso--connect.framer.media is currently listed as offline but retains a set of technical indicators that justify elevated risk classification for brand impersonation of Rabby. Registration records show the domain was created on 19 November 2021 through CSC Corporate Domains, Inc., and is hosted on Amazon’s infrastructure (ASN 16509) with the IP address 35.71.142.77 located in the United States. DNS resolution is serviced by four AWS name servers (ns-535.awsdns-02.net, ns-1854.awsdns-39.co.uk, ns-1267.awsdns-30.org, ns-97.awsdns-). The web server presents a Let’s Encrypt certificate (issuer E7) and enforces HSTS, while the HTTP response returns a 404 status code, indicating the original content is no longer reachable.

The page title that was captured before takedown reads “Rabby Wallet Review – Features, Security & Setup,” directly referencing the targeted brand and suggesting a likely attempt to lure Rabby users. Technology fingerprints identify Framer Sites, React, and HTTP/3, which are common in rapidly deployed fraudulent front‑ends. Threat intelligence flags the domain on one security blocklist and it is actively blocked by PhishDestroy. VirusTotal scans show five of ninety‑five anti‑malware engines flagged the domain, reinforcing suspicion of malicious intent.

While the site is presently offline, the combination of brand‑specific page title, use of a reputable SSL certificate to mask activity, and alignment with known impersonation patterns indicates a purposeful campaign to deceive Rabby users. Defenders should continue to block the domain at network perimeter, monitor for any re‑activation of the host, and add the IP address to threat‑intel feeds. Additional investigation is warranted if the domain becomes active again, focusing on payload delivery mechanisms and any credential‑harvesting forms that may be deployed under the same infrastructure.