wallet--us-rabby[.]framer[.]ai

The domain wallet--us-rabby.framer.ai is currently offline, returning an HTTP 404 status with the page title “Site Not Found | Framer”. Infrastructure analysis shows the domain is hosted on Amazon Web Services (IP 52.223.52.2, AS16509) and uses AWS Route 53 name servers (ns-1198.awsdns-21.org, ns-635.awsdns-15.net, ns-1902.awsdns-45.co.uk, ns-114.awsdns). A valid Let’s Encrypt certificate (E8) is present, and the site advertises HSTS and HTTP/3, indicating a modern TLS configuration. The domain was registered on 04 April 2023 through CSC Corporate Domains, Inc. The observed technology stack includes Framer Sites, React, and standard web security headers.

Threat intelligence flags the domain as a crypto‑related brand impersonation targeting the Rabby wallet application. Two of ninety‑five VirusTotal scanners flagged the host, and the domain appears on a single external blocklist, where it is listed by PhishDestroy. No additional public malware or phishing repositories have reported activity for this host, and the offline status prevents direct observation of any credential‑stealing page.

Given the combination of a brand‑targeted domain, a reputable SSL certificate, and explicit detection by security vendors, the domain should be treated as a confirmed crypto‑brand impersonation attempt. Defenders are advised to continue blocking the host at the DNS and URL filtering layers, monitor the IP range for future activations, and consider adding similar Framer‑hosted subdomains that reference Rabby to internal watchlists. Ongoing reconnaissance should verify whether the domain becomes active again, which would warrant immediate remediation.