auth-mitamask-logn[.]framer[.]media

Analysis indicates that the domain auth-mitamask-logn.framer.media is currently offline but retains infrastructure that can be re‑activated. The site resolves to the Amazon AWS address 35.71.142.77, belonging to ASN 16509 (Amazon.com, Inc.) and is hosted in the United States. The TLS certificate is issued by Let’s Encrypt (E7) and includes HSTS, while the web stack reports Framer Sites, React and HTTP/3 support. The page title observed during the brief capture reads “MetaMask Login – Getting Started with MetaMask*”, directly referencing the MetaMask brand, confirming a brand‑impersonation campaign. The domain was registered on 19 Nov 2021 through CSC Corporate Domains, Inc., and uses four AWS name servers (ns‑1267.awsdns‑30.org, ns‑1854.awsdns‑39.co.uk, ns‑535.awsdns‑02.net, ns‑97.awsdns‑).

VirusTotal records show 11 of 95 scanners flagging the domain as malicious. It appears on a single external blocklist and is listed by PhishDestroy as blocked. Google Safe Browsing classifies the site under social‑engineering threats. The HTTP response during the last check returned a 404 status, indicating the page is not currently serving content.

The overall threat profile is a crypto‑scam that attempts to harvest MetaMask credentials. Defenders should immediately add auth‑mitamask‑logn.framer.media to network deny lists and DNS sinkhole rules, monitor outbound connections to the associated AWS IP range, and enforce strict outbound filtering for TLS connections to unknown Let’s Encrypt‑issued sites that serve brand‑related content. Continuous threat‑intel feeds should be queried for any re‑activation of the domain or the hosting IP, and any alerts from VirusTotal, PhishDestroy, or Google Safe Browsing should be correlated. Incident response teams should also audit internal logs for attempted connections to this domain and educate users about unsolicited MetaMask login prompts, emphasizing that legitimate MetaMask interactions occur only through official wallet interfaces.