digital-metamsken-web[.]framer[.]media

On July 24, 2026 analysts observed the domain digital-metamsken-web.framer.media associated with a MetaMask brand impersonation campaign. The domain was registered on November 19, 2021 through CSC Corporate Domains, Inc. and resolves to the Amazon‑owned address 52.223.52.2, which is assigned to AS16509 (Amazon.com, Inc.) in the United States. DNS is served by four AWS name servers (ns-1854.awsdns-39.co.uk, ns-535.awsdns-02.net, ns-97.awsdns-12.com, ns-1267.awsdns-). The site presented a TLS certificate issued by Let’s Encrypt (E7) and advertised technologies typical of modern web builders, specifically Framer Sites, React, HSTS, and HTTP/3. The only visible artifact is the page title “Log In MetaMask: The Leading Crypto Wallet,” confirming an explicit attempt to lure MetaMask users.

HTTP requests return a 404 status, and the domain is currently taken offline, as indicated by the blocklist entry from PhishDestroy and a single inclusion on a security blocklist. VirusTotal scans record two positive detections out of ninety‑five scanners, reinforcing the malicious classification. The campaign is labeled a crypto scam, consistent with the brand‑targeted impersonation. Evidence gaps remain: no content capture, screenshots, or JavaScript analysis have been published, and the specific phishing kit or credential‑stealing mechanism is not disclosed.

Consequently, the full scope of victim interaction cannot be quantified. Defenders should update URL filtering rules to block the exact hostname, enforce DNS sink‑hole or NXDOMAIN responses for the domain, and monitor traffic to the associated IP address for any residual activity. Incident response teams should also consider adding the IP and its ASN to threat‑intel feeds, and security appliances should be configured to flag any TLS connections using the Let’s Encrypt E7 certificate tied to this domain. Continuous re‑evaluation is advised in case the actor re‑activates the site or re‑uses the infrastructure for new campaigns.