learn-metmskio-eng[.]framer[.]ai

The domain learn-metmskio-eng.framer.ai was observed returning an HTTP 404 status with the page title "Site Not Found | Framer," indicating that the host is no longer serving content. VirusTotal records show that eight of ninety‑five security scanners have flagged the domain, suggesting a moderate level of malicious detection. Google Safe Browsing categorises the site as a social engineering threat, and the domain appears on a single public blocklist where it is actively blocked by PhishDestroy. Infrastructure analysis reveals that the domain resolves to the IP address 35.71.142.77, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States.

The domain was registered on 06 January 2018 through CSC Corporate Domains, Inc., and uses a Let's Encrypt certificate (issuer E8) consistent with the Framer Sites platform. Detected technologies include Framer Sites, React, HTTP Strict Transport Security (HSTS), and HTTP/3, all of which are typical of legitimate Framer‑hosted sites but can also be leveraged by threat actors to lend credibility. The name servers are ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns, confirming the use of Amazon Route 53 DNS services.

While the site is currently offline, the combination of multiple vendor detections, Safe Browsing flagging, and blocklist inclusion indicates that the domain was previously employed for a generic phishing campaign. Defenders should continue to block the domain at perimeter controls, monitor for any re‑activation of the host, and consider adding the IP address 35.71.142.77 to deny‑list rules, especially in environments where Framer‑based content is not expected. Ongoing vigilance is advised to detect any future attempts to reuse the same infrastructure for similar social engineering attacks.