ssometamask-cdn[.]framer[.]ai

The domain ssometamask-cdn.framer.ai was observed hosting a page titled “Login to MetaMask – Secure Wallet Access Made Easy,” explicitly targeting MetaMask users. The site resolves to the IP address 52.223.52.2, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. Registration details show the domain was created on January 06, 2018 and was registered through CSC Corporate Domains, Inc. The TLS certificate is issued by Let’s Encrypt (certificate identifier E8), providing standard encryption but no additional trust signals. DNS resolution is handled by four AWS name servers: ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns.

HTTP probing returned a 404 status code, indicating the expected resource is missing or the site is intentionally returning an error page. Technical fingerprinting identified the use of Framer Sites, React, HTTP Strict Transport Security (HSTS), and HTTP/3, all common in modern web deployments but not indicative of malicious intent on their own. VirusTotal scans flagged the domain in 10 of 95 security engines, and the domain appears on a single external blocklist, reflecting moderate detection confidence. PhishDestroy has already taken the domain offline and classified it as a crypto‑related scam.

While the page title and brand impersonation are clearly linked to MetaMask, the actual content of the landing page has not been captured, leaving the exact phishing mechanics uncertain. Defenders should block the domain at the DNS and proxy layers, monitor for any resurgence of the same host or IP, and add the domain to internal threat intel feeds. Continued observation of the associated IP range (52.223.52.0/24) is advised, as the infrastructure may be repurposed for future malicious campaigns targeting cryptocurrency wallets.