learn-metamskio[.]framer[.]ai

On July 24, 2026, analysis of learn-metamskio.framer.ai confirms the domain is being used for a generic phishing operation. The site returned an HTTP 404 response with the page title “Site Not Found | Framer”, indicating the original content has been removed or the host is no longer serving the malicious payload. The domain resolves to 35.71.142.77, an Amazon Web Services address (AS16509, United States). DNS is served by four Amazon Route 53 name servers: ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns. Registration was performed through CSC Corporate Domains, Inc. on 6 January 2018.

The SSL certificate is issued by Let’s Encrypt (E8), confirming the presence of HTTPS. Threat intelligence sources have placed the domain on a single blocklist and it is actively blocked by PhishDestroy. Google Safe Browsing categorises the URL as “social engineering”, and five of ninety‑five VirusTotal scanners flagged the domain as malicious. Detected technologies include Framer Sites, React, HSTS, and HTTP/3, which are typical of legitimate Framer hosting but also common in illicit copy‑cat sites.

The current offline status limits immediate observation of payloads, leaving the exact phishing template unknown. Nonetheless, the convergence of a social‑engineering safe‑browsing label, multiple vendor detections, and blocklist inclusion provides sufficient confidence to treat the domain as a confirmed phishing host. Defenders should add the domain and its resolved IP address to deny‑list rules, monitor for any re‑appearance of content, and consider sinkholing the IP range if feasible. Ongoing surveillance of the associated AWS ASN is advised to detect potential re‑use of the infrastructure for future campaigns.