faqs-rabby-cdq[.]framer[.]media

The domain faqs-rabby-cdq.framer.media is currently offline but exhibits multiple indicators of a targeted brand‑impersonation campaign aimed at Rabby Wallet users. Registration data shows the domain was created on 19 November 2021 via CSC Corporate Domains, Inc., and is hosted on Amazon’s infrastructure (AS16509) in the United States, resolving to IP 52.223.52.2. The site served a TLS certificate from Let’s Encrypt (E7) and advertised HSTS and HTTP/3, suggesting a modern web stack built with Framer Sites and React.

The HTTP response returned a 404 status, and the page title captured by crawlers reads “Get started with Rabby extension – Rabby Wallet Official Guides,” directly referencing the Rabby brand. VirusTotal analysis recorded two detections out of ninety‑three scanners, and the domain appears on a single external blocklist (PhishDestroy). The nameserver configuration—ns‑1267.awsdns‑30.org, ns‑1854.awsdns‑39.co.uk, ns‑535.awsdns‑02.net, ns‑97.awsdns‑—further confirms reliance on AWS DNS services.

While the site is no longer reachable, the combination of brand‑specific page title, crypto‑scam labeling, and observed infrastructure indicates a deliberate attempt to lure Rabby users into a malicious workflow, likely involving wallet credential harvesting or unauthorized token transfers. Defenders should continue to block the domain at network perimeter devices, update URL filtering and threat intelligence feeds with the observed indicators, and monitor for any newly registered sub‑domains under the same registrar or similar naming patterns. Analysts should also correlate any reported Rabby wallet compromise attempts with traffic to the listed IP address or the associated AWS ASN, and consider adding the domain to internal blacklists even though it is presently offline.