metamaskwaletextension[.]framer[.]ai

Analysis of the domain metamaskwaletextension.framer.ai indicates a confirmed crypto scam targeting MetaMask users, currently offline as of July 24, 2026. The domain was registered through CSC Corporate Domains, Inc. on January 6, 2018, and resolves to the IP address 35.71.142.77, hosted on Amazon Web Services (AS16509) in the United States. Nameservers point to AWS DNS infrastructure, specifically ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns, suggesting cloud-based hosting consistent with phishing campaigns leveraging scalable infrastructure. The domain is flagged on one security blocklist (PhishDestroy) and was detected by 8 of 95 security vendors on VirusTotal, confirming its malicious classification.

The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its accessibility. Technologies detected include Framer Sites, React, HSTS, and HTTP/3, which may have been used to lend credibility to the phishing page. At the time of analysis, the domain returns an HTTP 404 status with the page title 'Site Not Found | Framer,' indicating it has been taken down or is no longer serving malicious content. The scam type is explicitly categorized as a crypto scam, and the domain impersonates MetaMask, a widely targeted cryptocurrency wallet brand.

While the exact content of the phishing page is not analyzed, the combination of brand impersonation, crypto scam classification, and detection by multiple security vendors supports the conclusion that this was an active threat prior to its removal. Defenders should treat this domain as malicious and monitor for any reactivation or related infrastructure. Network-level blocking of the IP 35.71.142.77 and associated domains registered through CSC Corporate Domains may mitigate residual risk. Further investigation into the hosting provider and registrar could uncover additional linked campaigns.