via-metamask[.]framer[.]ai

This domain, via-metamask.framer.ai, presents an elevated-risk phishing threat designed to impersonate MetaMask, a widely used cryptocurrency wallet service. The site mimics the official MetaMask login interface, displaying the page title 'Login to MetaMask – Secure Wallet Access Made Easy' to deceive users into entering sensitive credentials, including wallet recovery phrases or private keys. Such infrastructure is commonly associated with crypto drainer attacks, where stolen credentials are used to siphon digital assets from compromised wallets. The domain’s design and branding closely resemble legitimate MetaMask properties, increasing the likelihood of successful social engineering against unsuspecting users. Analysis of the domain reveals multiple technical indicators confirming its malicious nature. VirusTotal reports that 10 out of 95 security vendors flag via-metamask.framer.ai as malicious, while it appears on one security blocklist. The domain was registered on January 06, 2018, through CSC Corporate Domains, Inc., and currently resolves to the IP address 52.223.52.2, hosted on Amazon.com, Inc. infrastructure (AS16509). The SSL certificate is issued by Let’s Encrypt (serial number E8), a common practice among threat actors to lend a false sense of legitimacy to phishing pages. Despite its creation date suggesting longevity, the domain’s recent misuse for phishing aligns with patterns observed in short-lived, high-impact credential harvesting campaigns. Users who visited via-metamask.framer.ai or entered credentials on the site should take immediate action to mitigate potential compromise. First, revoke any active sessions or connected applications linked to the MetaMask wallet. Second, transfer all digital assets to a new, secure wallet using a fresh seed phrase generated on a trusted device. Monitor transaction histories for unauthorized activity and enable multi-factor authentication where available. If recovery phrases or private keys were exposed, assume the wallet is compromised and cease using it. Additionally, report the incident to relevant blockchain security teams and consider filing a complaint with domain abuse contacts for CSC Corporate Domains, Inc. to aid in takedown efforts.