metamask-access-eng[.]framer[.]ai

Analysis of metamask-access-eng.framer.ai, observed on 24 July 2026, indicates that the site is currently offline, returning a HTTP 404 status with the page title “Site Not Found | Framer”. The domain was registered on 6 January 2018 through CSC Corporate Domains, Inc., and is hosted on Amazon Web Services (AS16509) at IP address 35.71.142.77, a US‑based server. The TLS certificate is issued by Let’s Encrypt (E8) and includes HSTS and HTTP/3 support, consistent with the Framer Sites platform and a React front‑end.

Infrastructure signals are typical of legitimate hosting, but the domain name itself incorporates the MetaMask brand and the suffix “access‑eng”, a pattern commonly used in brand‑impersonation campaigns targeting cryptocurrency users. VirusTotal records show that nine of ninety‑five scanning engines flagged the domain, and the site appears on at least one security blocklist, with PhishDestroy confirming the entry. The domain is also classified as a “Crypto Scam” in the supplied intelligence.

Although the site is not reachable for direct content inspection, the combination of brand‑laden naming, the presence of a Let’s Encrypt certificate, and multiple vendor detections suggest a purposeful attempt to deceive MetaMask users. Defenders should continue to block the domain at network perimeter, monitor DNS queries for the four AWS name servers, and add the IP address to threat‑intel feeds. Ongoing vigilance is recommended, especially for users who may receive unsolicited links referencing MetaMask access or login pages, as the offline status may be temporary and the infrastructure could be reactivated for future campaigns.