connect-metamskio-cdm[.]framer[.]ai

The domain connect-metamskio-cdm.framer.ai is a confirmed phishing site engaged in brand impersonation targeting MetaMask, a cryptocurrency wallet service. It presents itself as a legitimate MetaMask login page to deceive users into entering sensitive credentials, posing an elevated risk of financial loss through cryptocurrency scams. No drainer kit was identified, but the site was actively used for credential theft before being taken offline.

Technical analysis reveals that connect-metamskio-cdm.framer.ai was flagged by 9 of 95 security vendors on VirusTotal, including ADMINUSLabs, ChainPatrol, and alphaMountain.ai. Google Safe Browsing classified it as 'SOCIAL_ENGINEERING' under phishing threats, and it appeared on one security blocklist, PhishDestroy. The domain was registered through CSC Corporate Domains, Inc. on January 6, 2018, and resolved to IP address 52.223.52.2, hosted on Amazon.com, Inc. infrastructure in the US. The SSL certificate was issued by Let's Encrypt (E8), and the observed page title mimicked MetaMask's official login portal. Technologies detected include Framer Sites, React, HSTS, and HTTP/3.

Users who interacted with connect-metamskio-cdm.framer.ai should immediately change their MetaMask passwords and enable two-factor authentication (2FA) on all accounts. Monitor financial transactions for unauthorized activity and consider revoking any token approvals granted during the suspected exposure period. Report the phishing domain to MetaMask's official support channels and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group (APWG) to aid in broader takedown efforts.