io-metamaskwebs[.]framer[.]ai

Analysis indicates that the domain io-metamaskwebs.framer.ai is currently offline and returns an HTTP 404 status, suggesting the malicious landing page is no longer reachable. The site was served over TLS with a Let's Encrypt certificate (E8), which provides encryption but does not attest to legitimacy. Technical fingerprinting shows the use of Framer Sites, React, HSTS, and HTTP/3, all typical of modern web applications, and the domain resolves to the AWS IP address 52.223.52.2 belonging to AS16509 (Amazon.com, Inc.) in the United States. The registrar listed is CSC Corporate Domains, Inc., and the domain was created on January 06, 2018.

Nameservers are AWS DNS endpoints (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns). The page title captured during earlier observations was "MetaMask Login – Secure Access to Web3," and the domain is explicitly marked as impersonating the MetaMask brand, classifying the activity as a crypto scam. Google Safe Browsing flags the site for social engineering, and PhishDestroy has blocked it, with the domain appearing on one external security blocklist.

VirusTotal reports ten of ninety‑five security vendors flagging the domain as malicious. While the offline status prevents direct verification of current content, the combination of brand impersonation, malicious page title, TLS certificate, hosting on a reputable cloud provider, and multiple security vendor detections provides strong evidence of a high‑risk phishing operation. Defenders should continue to block the domain at network perimeter, add it to internal threat intelligence feeds, monitor for newly registered subdomains under framer.ai that reference MetaMask or other Web3 services, and verify that no residual DNS records remain that could be re‑activated by the threat actor.