wellet-metamask-extentsion-us[.]framer[.]media

This domain, wellet-metamask-extentsion-us.framer.media, is flagged as a brand impersonation threat targeting MetaMask, a widely used cryptocurrency wallet. Analysis indicates the site is designed to deceive users into installing malicious browser extensions that facilitate unauthorized access to wallet credentials and cryptocurrency assets. The page title, 'Why Use the MetaMask Wallet Extension?,' mimics legitimate MetaMask educational content, increasing the likelihood of successful social engineering attacks. No explicit drainer kit signatures have been identified, but the infrastructure aligns with known wallet-draining campaigns observed in prior cryptocurrency phishing operations. Infrastructure analysis reveals the following technical indicators: the domain was registered on November 19, 2021, through CSC Corporate Domains, Inc., and resolves to the IP address 35.71.142.77, hosted on Amazon Web Services (AS16509). The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for both legitimate and malicious sites. VirusTotal detection rates show 17 out of 95 security vendors flagging the domain as malicious, while it appears on one active security blocklist. Google Safe Browsing (GSB) does not currently list the domain, suggesting either recent takedown or evasion of detection at the time of analysis. The domain is currently offline, likely due to hosting provider intervention or registrar enforcement. However, residual risk remains elevated due to the potential for infrastructure reuse or migration to new domains. Users who interacted with this site should assume credential compromise and take immediate action, including revoking wallet permissions, rotating passwords, and scanning for unauthorized transactions. Organizations should monitor for related domains leveraging similar naming conventions (e.g., 'metamask-extentsion') and update blocklists to include this infrastructure. The use of framer.media as a hosting platform underscores the trend of abusing legitimate services for phishing operations, necessitating heightened scrutiny of subdomains under such platforms.