rabby-wailat[.]framer[.]media

This domain is a confirmed brand impersonation threat targeting users of Rabby, a Web3 and cryptocurrency wallet. The site, titled 'Rabby Wallet – Secure Web3 & Crypto Wallet,' mimics the legitimate Rabby interface to deceive visitors into entering sensitive credentials, such as private keys or seed phrases. Infrastructure analysis reveals the page was designed to harvest authentication details, enabling unauthorized access to victims' crypto assets. The domain's deceptive design and alignment with known phishing tactics classify it as a high-risk threat to individuals engaging with decentralized finance platforms. Evidence supporting this classification includes multiple technical indicators. The domain was registered on November 19, 2021, through CSC Corporate Domains, Inc., and resolves to the IP address 35.71.142.77, hosted on Amazon.com, Inc.'s infrastructure (AS16509). Security vendors on VirusTotal flagged the domain as malicious, with 16 out of 95 engines detecting it. Additionally, the domain appears on three security blocklists and is actively blocked by multiple threat intelligence platforms. The SSL certificate, issued by Let's Encrypt (serial number E7), does not mitigate the risk, as phishing sites commonly use valid certificates to appear legitimate. Users who visited rabby-wailat.framer.media should immediately revoke any permissions granted to the site via wallet connections. If credentials or private keys were entered, affected parties must transfer assets to a new, secure wallet and monitor accounts for unauthorized transactions. Browser data, including cookies and cached files, should be cleared to remove any residual tracking mechanisms. Victims are advised to report the incident to relevant security teams and consider enabling additional authentication layers, such as hardware-based verification, to prevent future compromises.