connect-metamask[.]framer[.]media

Analysis of connect-metamask.framer.media indicates this domain was actively impersonating MetaMask, a cryptocurrency wallet service, as part of a crypto scam operation. The domain resolved to IP 52.223.52.2, hosted on Amazon Web Services (AS16509) in the United States, and was registered on November 19, 2021, through CSC Corporate Domains, Inc. Nameservers were configured under AWS DNS (awsdns-30.org, awsdns-02.net, awsdns-39.co.uk, awsdns-06.com), consistent with Framer Sites infrastructure, which was also detected as a technology in use alongside React, HSTS, and HTTP/3. The page title, 'Login to MetaMask – Secure Wallet Access Made Easy,' directly mimics MetaMask’s branding to deceive users into entering credentials or wallet recovery phrases. While the domain is currently offline (HTTP 404 status), it was flagged by at least one security blocklist and detected by 2 of 95 security vendors on VirusTotal as malicious.

The SSL certificate, issued by Let’s Encrypt (serial E7), does not mitigate the risk, as fraudulent domains commonly use valid certificates to appear legitimate. Infrastructure analysis reveals the domain leveraged Framer’s hosting platform, which is increasingly used for rapid deployment of phishing sites. The combination of MetaMask branding, crypto scam classification, and detection by security vendors confirms the intent to harvest cryptocurrency wallet credentials.

Defenders should treat this domain as compromised and block resolution at the DNS level. Historical logs should be reviewed for connections to 52.223.52.2 or interactions with the domain prior to its takedown. No additional content analysis is available, as the site is no longer accessible.