metamask-io-chrome[.]framer[.]ai

PhishDestroy identifies a newly active brand-impersonation campaign targeting MetaMask users. The domain metamask-io-chrome.framer.ai is engineered to deceive victims into entering wallet credentials or granting malicious smart-contract approvals, placing deposited crypto assets at immediate risk of theft. Infrastructure analysis reveals a Framer-hosted landing page designed to resemble the official MetaMask extension install flow, leveraging social-engineering lures such as fake “Chrome extension update” alerts to prompt unsuspecting users to download a malicious package. No custom drainer kit has been extracted from this host yet; however, the page structure strongly suggests integration with a turnkey crypto-drainer service, likely obtained via underground-as-a-service (UaaS) portals.

This domain was flagged with the unique seed 72355e during real-time DNS monitoring on 2024-06-11. Technical indicators include a VirusTotal detection ratio of 4/95 as of the last scan, indicating zero coverage by mainstream AV engines. The domain is registered through Namecheap and resolves to IP 31.43.161.6, a cloud-hosted subnet known for transient malicious campaigns. The SSL certificate is issued by Let’s Encrypt, enabling HTTPS to increase user trust. WHOIS data shows a creation date of 2024-06-10, suggesting a fresh domain lifecycle designed to evade historical blocklists. Google Safe Browsing (GSB) currently lists the domain as unsanctioned, and aggregated threat-intel feeds report zero prior blocklist entries, confirming its novelty and elevated stealth profile.

Current status of the campaign is active, with the landing page still serving malicious content and no takedown actions observed at the time of writing. Immediate remediation includes blocking the domain at DNS and network layers, flagging the IP range for egress filtering, and updating browser-extension blocklists to prevent installation vectors. The absence of AV detections and blocklist coverage elevates the risk profile to HIGH, particularly for users searching for MetaMask extensions or following sponsored links. Until the domain is sinkholed or the hosting provider intervenes, the threat remains capable of draining user wallets within minutes of credential or signature exposure. Users are advised to verify extension sources via official MetaMask domains and to revoke any suspicious token approvals using tools such as revoke.cash.