enus-metamask[.]framer[.]media

Analysis of enus-metamask.framer.media indicates a brand impersonation campaign targeting MetaMask users, classified as a crypto scam. The domain was registered on February 21, 2026, through CSC Corporate Domains, Inc., and is currently offline with an HTTP 404 status. Infrastructure analysis reveals hosting on Amazon Web Services (AS16509) at IP 35.71.142.77, located in the US, with nameservers under AWS DNS management. The SSL certificate is issued by Let's Encrypt (E7), and technologies detected include Framer Sites, React, and HSTS with HTTP/3 support.

The page title, 'Site Not Found | Framer,' suggests the site may have been taken down or altered post-detection. Security vendors flagged this domain on VirusTotal, with 10 of 95 engines identifying it as malicious. It appears on one security blocklist and is blocked by PhishDestroy. While the domain is currently inactive, its prior association with MetaMask impersonation and crypto scam activity warrants continued monitoring.

Defenders should treat any future resolution of this domain as high-risk, particularly for users interacting with cryptocurrency services. The use of Framer Sites as a hosting platform is notable, as it may enable rapid deployment and takedown of phishing pages. No additional details about the scam mechanics or payload delivery are available from the current data. Review of related infrastructure, such as linked IPs or co-hosted domains, is recommended to identify potential campaign expansion.