rabby-us[.]framer[.]media

Analysis of rabby-us.framer.media, observed on July 24, 2026, indicates that the domain is part of an elevated‑risk brand‑impersonation campaign targeting the Rabby cryptocurrency wallet. The domain was registered on February 21, 2026 through CSC Corporate Domains, Inc., and resolves to the Amazon Web Services host 52.223.52.2, which belongs to ASN 16509 (Amazon.com, Inc.) located in the United States. The site operated over an HTTPS endpoint issued by Let’s Encrypt (certificate identifier E7) and advertised modern web technologies including Framer Sites, React, HSTS and HTTP/3. HTTP probing returned a 404 status, suggesting that the landing page is no longer available after the takedown.

The page title that was captured before offline status read “Rabby Wallet | Wallet for Ethereum and EVM,” confirming the attempt to mimic the legitimate Rabby product. The domain appears on three security blocklists, specifically PhishDestroy, MetaMask, and SEAL, and was flagged by two of ninety‑three VirusTotal scanners, reinforcing the malicious classification. Evidence of the campaign’s infrastructure is limited to the observed IP address, registrar information, SSL certificate, and the listed Amazon Route 53 nameservers (ns‑97.awsdns‑12.com, ns‑1854.awsdns‑39.co.uk, ns‑535.awsdns‑02.net, and an additional ns‑1 entry).

No further indicators such as payload samples, credential‑stealing forms, or additional hosting footprints were disclosed. Defenders should continue to block the domain at network perimeter, update URL filtering lists with the observed blocklist entries, and monitor for any resurgence of the host or related subdomains under the same registrar or ASN. Continuous observation of the IP 52.223.52.2 for new domain registrations may reveal follow‑up campaigns.