access-metasmk[.]framer[.]ai

The domain access-metasmk.framer.ai is a confirmed phishing site engaged in brand impersonation targeting MetaMask, a cryptocurrency wallet service. This site posed as a legitimate MetaMask login page to deceive users into entering sensitive credentials, potentially leading to unauthorized access to crypto wallets. No drainer kit was identified, but the site was actively used for cryptocurrency-related phishing. As of the latest verification, access-metasmk.framer.ai has been taken offline.

Technical analysis of access-metasmk.framer.ai reveals limited detection, with only 1 of 95 VirusTotal security vendors flagging the domain. The domain was registered through CSC Corporate Domains, Inc. on January 06, 2018, and resolved to the IP address 35.71.142.77, hosted on Amazon.com, Inc. infrastructure in the US. It appeared on a single security blocklist (PhishDestroy) and was not flagged by Google Safe Browsing. The SSL certificate was issued by Let's Encrypt (E8), and the observed page title was 'Metamask Login: Secure Access to Your Crypto Wallet'. The site used technologies including Framer Sites, React, HSTS, and HTTP/3, and currently returns an HTTP 404 status.

Users who interacted with access-metasmk.framer.ai should immediately change their MetaMask credentials and enable two-factor authentication (2FA) on all accounts. If wallet access was entered, revoke any active token approvals and transfer funds to a new, secure wallet to prevent unauthorized transactions. Monitor accounts for suspicious activity and report the phishing domain to platforms such as Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group (APWG) to aid in broader mitigation efforts.