metamask-web[.]framer[.]website

This domain, metamask-web.framer.website, is flagged for brand impersonation targeting MetaMask, a widely used cryptocurrency wallet service. Analysis indicates the site mimics the official MetaMask login interface to deceive users into entering sensitive credentials, such as seed phrases or private keys, which are then harvested by threat actors. The domain does not appear to deploy a known drainer kit but relies on social engineering to compromise victim accounts directly. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was registered through CSC Corporate Domains, Inc. on November 19, 2021, and resolves to the IP address 52.223.52.2, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for both legitimate and fraudulent sites. VirusTotal detection shows 9 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist and is blocked by PhishDestroy. The page title, 'MetaMask Login – Secure Access to metamask login,' further confirms its intent to impersonate the legitimate MetaMask portal. As of the latest assessment, metamask-web.framer.website has been taken offline, reducing immediate exposure to potential victims. However, residual risk remains due to the domain's historical activity and the possibility of re-emergence under a similar or altered infrastructure. Users who may have interacted with this domain are advised to revoke any connected sessions, rotate credentials, and monitor associated accounts for unauthorized transactions. Organizations should update blocklists to include this domain and its resolved IP to prevent future access attempts. Continuous monitoring of newly registered domains with similar naming patterns is recommended to mitigate recurring threats.