en-extensionmeta[.]framer[.]ai

This domain, en-extensionmeta.framer.ai, poses a direct threat as a brand impersonation scheme targeting MetaMask users. The site mimics the official MetaMask extension portal, presenting itself as 'MetaMask Extension – Your Gateway to the World of Web3.' Analysis indicates the infrastructure was designed to deceive users into interacting with fraudulent Web3 or cryptocurrency services, likely leading to credential harvesting or wallet-draining attacks. The page title and branding elements closely replicate legitimate MetaMask communications, increasing the likelihood of successful social engineering against unsuspecting victims. Evidence supporting the malicious nature of this domain includes multiple technical indicators. The domain was registered on March 04, 2026, through CSC Corporate Domains, Inc., a registrar frequently associated with high-risk domains. It resolves to the IP address 31.43.161.6 and is currently listed on three security blocklists. VirusTotal reports that 3 out of 95 security vendors flag this domain as malicious. The SSL certificate is issued by Let's Encrypt, a common choice for threat actors due to its accessibility. Detected technologies include Framer Sites, React, HSTS, and HTTP/3, which are consistent with modern phishing infrastructure designed to appear legitimate. Users who visited en-extensionmeta.framer.ai should take immediate action to mitigate potential risks. If any credentials, recovery phrases, or private keys were entered on the site, affected users must transfer assets to a new, secure wallet and revoke any connected dApp permissions. Browser extensions or applications downloaded from this domain should be removed, and systems scanned for malware. Additionally, users should monitor accounts for unauthorized transactions and enable multi-factor authentication where available. Given the domain's elevated risk level and offline status, victims are advised to remain vigilant for follow-up phishing attempts via email or social media.