metamaskwellet-extension-en[.]framer[.]media

This domain, metamaskwellet-extension-en.framer.media, is flagged as a brand impersonation threat targeting MetaMask, a widely used cryptocurrency wallet. Registered on November 19, 2021, the domain was hosted on infrastructure associated with Amazon Web Services (AS16509) at IP address 35.71.142.77, located in the United States. The site was built using Framer Sites and React, with HTTP/3 and HSTS enabled, suggesting a modern web presence designed to appear legitimate. The page title, 'Metamask Wallet Extension: Your Gateway to Web3,' directly aligns with MetaMask’s branding and functionality, reinforcing the impersonation narrative. Analysis indicates the domain was detected by 15 of 95 security vendors on VirusTotal, though the absence of additional context limits the granularity of these detections.

It was also listed on one security blocklist, specifically PhishDestroy, and is currently offline with an HTTP 404 status. The domain’s SSL certificate was issued by Let’s Encrypt (serial E7), a common certificate authority, which does not inherently indicate malicious activity but is frequently leveraged in phishing campaigns due to its accessibility. The registrar, CSC Corporate Domains, Inc., is a legitimate provider, and the nameservers (ns-97.awsdns-12.com, ns-535.awsdns-02.net, ns-1267.awsdns-30.org, ns-1854.awsdns-39) are consistent with AWS Route 53 configurations. While the domain’s current offline status reduces immediate risk, defenders should treat it as part of a broader pattern of MetaMask impersonation.

The use of Framer Sites, a platform typically associated with legitimate design and prototyping, may have been intended to lend credibility to the scam. The exact content and functionality of the site remain unanalyzed, but the combination of branding, page title, and known crypto scam classification suggests it was likely designed to deceive users into divulging wallet credentials or installing malicious extensions.