connect--metamasck[.]framer[.]media

The domain connect--metamasck.framer.media is a phishing site engaged in brand impersonation targeting MetaMask, a cryptocurrency wallet service. It presents itself as an official MetaMask login and recovery page to deceive users into entering sensitive credentials or wallet details, posing a risk of cryptocurrency theft. As of the latest verification, connect--metamasck.framer.media has been taken offline, but it previously operated as an active scam site.

Technical analysis reveals that connect--metamasck.framer.media was flagged by 1 of 95 security vendors on VirusTotal, including ChainPatrol, while Google Safe Browsing did not detect it. The domain appears on one security blocklist, PhishDestroy, and is registered through CSC Corporate Domains, Inc., with a creation date of November 19, 2021. It resolves to the IP address 52.223.52.2, hosted on Amazon.com, Inc. infrastructure (AS16509) in the US. The SSL certificate is issued by Let's Encrypt (E7), and the observed page title was 'MetaMask Login & Recovery | Official'. The site employed technologies such as Framer Sites, React, HSTS, and HTTP/3, and currently returns an HTTP 404 status.

Users who may have interacted with connect--metamasck.framer.media should immediately change their MetaMask credentials and enable two-factor authentication if applicable. For cryptocurrency wallets, revoke any token approvals granted to unknown or suspicious addresses and transfer funds to a new wallet. Report the domain to MetaMask's official abuse channels and consider submitting it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in broader mitigation efforts.