home-metamks[.]framer[.]ai

This domain home-metamks.framer.ai is currently flagged as an elevated‑risk brand‑impersonation site targeting MetaMask users. The domain resolves to the Amazon AWS IP address 52.223.52.2, which is announced by AS16509 (Amazon.com, Inc.) and is geolocated in the United States. DNS resolution is served by the four AWS Route 53 name servers ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk and ns-635.awsdns. The site was registered on 06 January 2018 through CSC Corporate Domains, Inc. The TLS certificate is issued by Let’s Encrypt (identifier “E8”) and the server presents HSTS and HTTP/3 support, indicating a modern web stack that includes Framer Sites and React. An HTTP request returns a 404 status code, and the page title returned by the server is “Sign In | Metamask - Log In”, which directly references the MetaMask brand.

Google Safe Browsing classifies the URL as social engineering, and the domain appears on a single public blocklist, where it has been listed by PhishDestroy. VirusTotal analysis shows that eight of ninety‑five scanning engines have flagged the domain, reinforcing the malicious classification. The intelligence tags the activity as a crypto‑scam, specifically a brand‑impersonation attempt aimed at credential harvesting for MetaMask wallets. Because the host is currently taken offline, live content cannot be inspected, and the exact phishing page layout remains unknown.

Nevertheless, the combination of brand‑specific page title, the social‑engineering Safe Browsing label, the presence on a blocklist, and multiple vendor detections provides sufficient evidence for defensive action. Organizations should block DNS resolution to 52.223.52.2 and add home‑metamks.framer.ai to URL filtering and email security policies. Continuous monitoring of the associated AWS name servers and the registrar CSC Corporate Domains, Inc. is advised in case the site is re‑hosted under a different IP address.