rabby-io[.]framer[.]media

This domain, rabby-io.framer.media, is assessed as a brand impersonation threat targeting Rabby, a cryptocurrency wallet service. Analysis indicates the domain was created on November 19, 2021, and is registered through CSC Corporate Domains, Inc. The page title, 'Rabby Wallet Login | Best Rabby Wallet Extension,' directly mimics official Rabby branding, aligning with the reported scam type of crypto fraud. The domain resolves to IP 52.223.52.2, hosted on Amazon Web Services (AS16509) in the United States, and uses nameservers under awsdns (ns-1267.awsdns-30.org, ns-1854.awsdns-39.co.uk, ns-97.awsdns-12.com, ns-535.awsdns-XX.net). As of the latest check, the domain returns an HTTP 404 status, suggesting it is currently offline or taken down.

Security vendor detection on VirusTotal shows 13 of 95 engines flagging the domain, and it appears on one blocklist (PhishDestroy). SSL certificate analysis reveals a Let's Encrypt certificate (E7), and technologies detected include Framer Sites, React, HSTS, and HTTP/3. Defenders should treat this domain as a confirmed phishing endpoint for Rabby wallet credentials or crypto-related fraud.

While the domain is offline, historical resolution and detection data indicate prior malicious activity. No evidence of active compromise or live content is available at this time, but the domain should remain blocked and monitored for reactivation. Further investigation into associated IPs, certificate chains, and hosting infrastructure is recommended to identify linked campaigns.