wallet-rabby-hlp[.]framer[.]media

This domain, wallet-rabby-hlp.framer.media, is identified as a high-risk brand impersonation threat targeting Ethereum users. Analysis indicates the site mimics the Rabby Wallet extension, a legitimate Ethereum-compatible wallet, to deceive victims into interacting with fraudulent crypto services. The domain does not exhibit direct indicators of a crypto drainer kit but employs social engineering tactics to harvest credentials or manipulate users into transferring assets to attacker-controlled addresses. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 11 out of 95 security vendors on VirusTotal, registered through CSC Corporate Domains, Inc., and resolves to the IP address 52.223.52.2 (AS16509, Amazon.com, Inc.). The domain was created on November 19, 2021, and is currently flagged by Google Safe Browsing as a phishing site. It appears on one security blocklist, and its SSL certificate is issued by Let's Encrypt (serial number E7). The page title, 'Rabby Wallet | Best Rabby Wallet Extension,' further confirms its intent to impersonate the legitimate Rabby Wallet brand. As of the latest assessment, wallet-rabby-hlp.framer.media has been taken offline, reducing immediate exposure to potential victims. However, the domain remains registered and could be reactivated or repurposed for future malicious campaigns. Organizations and users are advised to block the domain and its associated IP address at the network level. Crypto wallet providers should monitor for user reports of brand impersonation and educate users on verifying official domains before entering credentials or approving transactions. Persistent monitoring of newly registered domains with similar naming patterns is recommended to mitigate residual risk.