metamaskwaleetextension[.]framer[.]ai

The domain metamaskwaleetextension.framer.ai was observed hosting a counterfeit site that purports to impersonate the MetaMask cryptocurrency wallet. The site returned an HTTP 404 status with the page title “Site Not Found | Framer”, indicating that the content is no longer accessible. The domain resolves to the IP address 52.223.52.2, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. Registration data shows the domain was created on 6 January 2018 and is registered through CSC Corporate Domains, Inc., using the nameservers ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns. The TLS certificate is issued by Let’s Encrypt (certificate identifier E8), and the site employed modern web technologies including Framer Sites, React, HTTP/3, and HTTP Strict Transport Security (HSTS).

Analysis by VirusTotal indicates that nine out of ninety‑five security vendors flagged the domain, reflecting a moderate detection rate. The domain appears on a single blocklist, PhishDestroy, which has listed it as a malicious entry. No additional public blocklists or Safe Browsing entries were identified in the available data. The observed scam type is classified as a crypto scam, targeting MetaMask users, though the exact phishing payload or credential‑stealing mechanism has not been disclosed. The domain is part of the Framer hosting platform, which provides a template‑based site builder; the presence of HSTS and HTTP/3 suggests the operator configured modern security headers despite the malicious intent.

The fact that the domain was created in 2018 but only recently observed indicates possible reuse of long‑standing registrations for new campaigns, a pattern seen in other crypto‑related abuse. Given the current offline status, active mitigation is limited to ensuring that any cached or historic references to the domain are blocked at network perimeter devices.