metamasks[.]framer[.]media

On July 24, 2026, the domain metamasks.framer.media was flagged as a brand impersonation threat targeting MetaMask, a popular cryptocurrency wallet. The domain was created on November 19, 2021, and analysis indicates it was used to impersonate MetaMask with the page title 'MetaMask Login Process: A Step-by-Step Guide.' The domain has been taken offline and currently returns an HTTP 404 status, suggesting that the content is no longer accessible. Four out of 93 security vendors on VirusTotal have flagged this domain as malicious, indicating a moderate level of detection among the security community. The domain is also listed on the PhishDestroy blocklist, further confirming its association with phishing activities.

The SSL certificate for the domain is provided by Let's Encrypt, which is a common choice for legitimate and malicious sites alike. The domain resolves to the IP address 52.223.52.2, located in the United States and hosted by Amazon.com, Inc. (AS16509). The domain is registered through CSC Corporate Domains, Inc., and uses nameservers associated with AWS. The technologies detected on the domain include Framer Sites, React, HSTS, and HTTP/3, which are commonly used in modern web development.

Given the elevated risk level and the presence of the domain on a security blocklist, defenders are advised to treat any activity related to metamasks.framer.media with caution. Although the domain is currently offline, it may be reactivated in the future, and users should be wary of any unsolicited communications directing them to this domain. Defenders should monitor for any attempts to register similar domains and ensure that their systems are updated with the latest threat intelligence to prevent potential future attacks.