metamasklogin[.]framer[.]ai

Analysis as of July 23, 2026 indicates that the domain metamasklogin.framer.ai is currently offline but exhibits multiple indicators of a brand-impersonation campaign targeting MetaMask users. The domain was registered through CSC Corporate Domains, Inc. on January 06, 2018 and is hosted on Amazon Web Services (ASN 16509) in the United States, resolving to IP address 52.223.52.2. The server presents a valid Let’s Encrypt certificate (identifier E8) and advertises modern protocols such as HTTP/3 and HSTS, which are typical of legitimate services but can also be leveraged by malicious actors to increase trust. The site’s HTML title reads “MetaMask: The Leading Crypto Wallet Platform, Blockchain Wallet,” directly referencing the MetaMask brand, and the underlying technology stack includes Framer Sites and React, suggesting the use of a templated site builder.

VirusTotal scans have flagged the domain on 12 of 95 security engines, and the domain is listed on at least one external blocklist. PhishDestroy has actively blocked the domain, and it appears on a security blocklist, reinforcing the perception of malicious intent. The observed scam type is classified as a crypto scam, consistent with the MetaMask brand impersonation. The HTTP response code is 404, indicating that the page content is not currently served, which aligns with the reported offline status.

Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms that may have been hosted when the site was active, as the current HTTP 404 response prevents direct content analysis. No public Safe Browsing verdict or OTX indicator is cited in the available data. Defenders should continue to monitor the associated IP address 52.223.52.2 for any reactivation, enforce outbound filtering for the domain name, and add the domain to internal blocklists. Additional surveillance of the nameservers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.