welcome-metamusk-app[.]framer[.]ai

On July 24, 2026, the domain welcome-metamusk-app.framer.ai was observed to host a site titled “Login to MetaMask – Secure Wallet Access Made Easy”. The page title explicitly references MetaMask, indicating a brand impersonation campaign targeting users of the MetaMask cryptocurrency wallet. The domain was registered through CSC Corporate Domains, Inc. on January 6, 2018. DNS resolution points to the IP address 52.223.52.2, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The hosting environment serves content over HTTPS using a Let’s Encrypt certificate (issuer E8) and supports HSTS and HTTP/3, suggesting a modern web stack.

Detected technologies include Framer Sites and the React JavaScript library, consistent with the use of a Framer‑based site builder. Security telemetry shows that the site returned an HTTP 404 status at the time of analysis, and the infrastructure has been taken offline. Nonetheless, the domain appears on one security blocklist and was actively blocked by the PhishDestroy service. VirusTotal scans recorded eight detections out of ninety‑five antivirus engines, reinforcing the malicious classification. The nameserver set comprises ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns, all belonging to Amazon’s Route 53 service, confirming the use of AWS DNS infrastructure.

The evidence points to a crypto‑related scam that leverages the MetaMask brand to harvest credentials or lure victims into fraudulent transactions. While the site is currently offline, the persistence of the domain registration and the use of reputable cloud services indicate the potential for rapid re‑deployment. Defenders should continue to monitor the domain and associated IP address for re‑activation, enforce blocklist entries in perimeter defenses, and update endpoint protection signatures to include the observed VirusTotal detections.