metamask-us-en[.]framer[.]media

This domain, metamask-us-en.framer.media, is assessed as an elevated-risk brand impersonation site targeting MetaMask, a cryptocurrency wallet service. Infrastructure analysis reveals the domain was created on November 19, 2021, and registered through CSC Corporate Domains, Inc. It resolves to IP address 35.71.142.77, hosted on Amazon Web Services (AS16509) in the United States. The domain is currently offline, returning an HTTP 404 status, but was previously flagged by 11 of 95 security vendors on VirusTotal and appears on at least one security blocklist, specifically PhishDestroy. The page title, 'Login to MetaMask – Secure Wallet Access Made Easy,' directly aligns with the known scam type: a crypto scam.

Technologies detected include Framer Sites, React, HSTS, and HTTP/3, which are not inherently malicious but are consistent with modern phishing infrastructure. The domain uses a Let's Encrypt SSL certificate (E7), which provides encryption but does not validate legitimacy. Nameservers are hosted on AWS (ns-97.awsdns-12.com, ns-535.awsdns-02.net, ns-1854.awsdns-39.co.uk, ns-1267.awsdns-48.org), a common hosting provider for both legitimate and malicious sites. Defenders should treat this domain as confirmed malicious due to its presence on security blocklists, detection by multiple security vendors, and alignment with known MetaMask impersonation tactics.

The domain's current offline status does not eliminate risk, as it may resurface under the same or similar infrastructure. Organizations should block the domain and IP at the network level, monitor for related subdomains or newly registered lookalike domains, and alert users to the specific threat of crypto wallet phishing targeting MetaMask. No additional evidence of the site's content or functionality is available, so further analysis of its operational behavior is not possible at this time.