wallet-us-trezor-eng[.]framer[.]media

This domain, wallet-us-trezor-eng.framer.media, was observed hosting a Trezor brand‑impersonation page titled “Rabby Wallet Login | Best Rabby Wallet Extension”. The site resolved to the Amazon Web Services address 35.71.142.77, which belongs to ASN 16509 (Amazon.com, Inc.) and is geolocated in the United States. Registration records show the domain was created on 19 November 2021 through CSC Corporate Domains, Inc., and is served by the four AWS name servers ns‑97.awsdns‑12.com, ns‑1854.awsdns‑39.co.uk, ns‑1267.awsdns‑30.org and ns‑535.awsdns‑?. The TLS certificate is issued by Let’s Encrypt (E7) and the site advertised HSTS and HTTP/3 support.

Automated scans indicate the underlying technology stack includes Framer Sites and React. VirusTotal reports that twelve of ninety‑five scanning engines flagged the domain as malicious, and the domain appears on a single external blocklist. PhishDestroy has already taken the site offline, and the current HTTP response is a 404 status code, confirming the content is no longer reachable.

While the offline status limits direct examination of the page’s payload, the combination of brand‑targeted title, SSL certificate, and detection history strongly suggests a crypto‑focused impersonation campaign aimed at harvesting credentials for Trezor wallets. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑registration attempts, and incorporate the IP address and name‑server set into threat‑intel feeds. Ongoing vigilance is advised because the infrastructure – AWS hosting and a publicly issued Let’s Encrypt certificate – can be reused for future campaigns.