help-metamask-doc[.]framer[.]ai

Analysis of the domain help-metamask-doc.framer.ai shows a clear pattern of brand impersonation targeting MetaMask users. The site presents the page title "MetaMask Login – Secure Access to Web3," indicating an attempt to lure victims into a credential‑harvesting flow. Technical observations confirm the domain is hosted on Amazon Web Services (IP 35.71.142.77, AS16509, United States) and is served over HTTPS with a Let’s Encrypt certificate (E8). The presence of Framer Sites, React, HSTS and HTTP/3 suggests a modern web stack typical of phishing kits that replicate legitimate login portals.

The domain resolves to a 404 HTTP status, and the infrastructure has been taken offline, yet historical data remains relevant for detection. Security‑vendor scans on VirusTotal recorded two detections out of ninety‑five scanners, and Google Safe Browsing classified the site as a social‑engineering threat. The domain appears on a single security blocklist and is actively blocked by PhishDestroy, reinforcing the consensus that it is malicious.

Registration records show the domain was created on 6 January 2018 and is registered through CSC Corporate Domains, Inc., a registrar commonly used by malicious operators. While the site is currently inactive, defenders should continue to block the domain and its associated IP address, monitor for any re‑registration attempts, and update detection signatures to flag the specific page title and SSL certificate fingerprint. The combination of brand impersonation, crypto‑scam labeling, and confirmed vendor detections warrants an elevated risk rating and proactive defensive measures.