extension-platform[.]framer[.]ai

PhishDestroy identifies extension-platform.framer.ai as a crypto drainer scam designed to trick users into installing malicious browser extensions that drain cryptocurrency wallets. The domain masquerades as a legitimate platform for extension distribution, leveraging the trusted Framer.ai branding to appear credible. Attackers typically distribute links to this domain through social engineering tactics such as fake support messages, social media promotions, or deceptive advertisements, luring victims into downloading compromised extensions that exfiltrate private keys or seed phrases. This domain presents multiple red flags confirmed by independent threat intelligence. VirusTotal analysis by PhishDestroy reveals zero detections out of 95 security engines, indicating this threat is currently under the radar of most antivirus solutions. The domain resolves to IP address 31.43.161.6 and operates with a Let's Encrypt SSL certificate to appear legitimate. Security research shows it is currently blocked by MetaMask and SEAL security systems. Blocklist monitoring indicates the domain appears on at least two active security blocklists, suggesting it has been flagged by multiple threat intelligence platforms. While the exact creation date and registrar details are not specified in available intelligence, the combination of zero VirusTotal detections with active blocking by security tools raises significant concern about its malicious intent. Users who have visited extension-platform.framer.ai should immediately cease any interaction with this domain and avoid downloading any files or extensions offered on the site. If any browser extensions were installed from this domain, users are strongly advised to revoke permissions, transfer remaining funds to a new wallet, and perform a full browser reset. Consider running a malware scan using reputable security software and monitor cryptocurrency wallet transactions closely for unauthorized activity. Report any suspicious transactions or installations to your wallet provider and relevant security platforms to help prevent further victimization. Given the current under-investigation status, this threat could escalate as more evidence emerges, making immediate caution essential.