assets-metamskk-us[.]framer[.]media

Analysis indicates that the domain assets-metamskk-us.framer.media is actively leveraged for brand impersonation of MetaMask. The site resolves to the Amazon-owned IP address 52.223.52.2, located in the United States under ASN 16509 (Amazon.com, Inc.). Registration data shows the domain was created on 19 November 2021 through CSC Corporate Domains, Inc., and the authoritative name servers are ns-1267.awsdns-30.org, ns-1854.awsdns-39.co.uk, ns-535.awsdns-02.net, and ns-97.awsdns-. The TLS certificate is issued by Let’s Encrypt (E7) and the site presents HTTP Strict Transport Security (HSTS) and HTTP/3 support, consistent with the Framer Sites and React technology stack identified. The page title returned by the server is “MetaMask Login – Getting Started with MetaMask”, confirming a direct attempt to lure MetaMask users.

The HTTP response code is 404, indicating the endpoint is no longer serving content, and the domain is currently marked as offline. Despite the offline status, the domain is listed on one public security blocklist and is actively blocked by PhishDestroy. Google Safe Browsing classifies the URL as a social‑engineering threat, and VirusTotal records 14 positive detections out of 95 scanned vendors. Scamadviser assigns a trust score of 1 / 100, reflecting extreme risk. Evidence points to a crypto‑scam motive, as the campaign is labeled “Crypto Scam” and explicitly impersonates the MetaMask brand.

The presence of HSTS and HTTP/3 suggests the operators employed modern web infrastructure to increase credibility. Uncertainty remains regarding the exact payload or credential‑harvesting mechanism, as the site returns a 404 page and no further content has been captured. Defenders should add the domain and its associated IP address to blocklists, enforce outbound filtering for the identified nameservers, and monitor for similar Framer‑based impersonation patterns. Continuous re‑scanning of the domain is advised in case the hosting is reinstated.