extension-wellet-metamask-ask[.]framer[.]ai

The domain extension-wellet-metamask-ask.framer.ai was created on January 06, 2018 and is registered through CSC Corporate Domains, Inc. DNS resolution points to the IP address 35.71.142.77, an Amazon Web Services host in the United States associated with ASN 16509. The domain serves a single HTTP response with status code 404 and presents the page title "Site Not Found | Framer". TLS is provided by a Let’s Encrypt certificate (issuer E8) and the site advertises HSTS and HTTP/3 support, indicating a modern web stack built on Framer Sites and React. Google Safe Browsing flags the domain for social engineering, and PhishDestroy has listed it as blocked.

VirusTotal records nine detections out of ninety‑five scanning engines, and the domain appears on one external security blocklist. The site is classified as a crypto‑related scam that impersonates the MetaMask brand, aligning with the observed brand target. Nameserver configuration includes ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns, all belonging to Amazon’s DNS service. Current monitoring shows the domain is offline, limiting live payload analysis.

Uncertainty remains regarding any credential‑harvesting pages or malicious scripts that may have been hosted before takedown, as no content beyond the 404 response was captured. Defensive recommendations include adding the domain and its resolving IP to URL filtering and network‑level blocklists, monitoring for any future re‑use of the AWS IP range, and alerting endpoints that query MetaMask‑related URLs for anomalous redirects. Organizations should also review logs for attempts to contact this host and enforce strict verification of MetaMask communications to mitigate brand‑impersonation risk.