visiti-metaskkloginn-x-sso[.]framer[.]media

On 24 July 2026, the domain visiti-metaskkloginn-x-sso.framer.media was observed offline but retains indicators of a confirmed crypto‑related scam targeting MetaMask users. The site was registered on 19 November 2021 through CSC Corporate Domains, Inc., and resolves to the Amazon Web Services IP address 52.223.52.2, which is assigned to ASN 16509 (Amazon.com, Inc.) and geolocated to the United States. Technical fingerprints show the use of Framer Sites and a React front‑end, with HTTP/3 enabled and HSTS enforced. The TLS certificate is issued by Let’s Encrypt (profile E7), confirming the presence of a valid HTTPS service at the time of capture.

An HTTP request returned a 404 status code, and the page title presented as “MetaMask Sign In – Access Your Ethereum Wallet,” directly referencing the MetaMask brand and indicating a crypto‑wallet impersonation attempt. The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy. VirusTotal analysis recorded six positive detections out of ninety‑five scanners, reinforcing the malicious classification. Nameserver configuration includes ns‑535.awsdns‑02.net, ns‑1267.awsdns‑30.org, ns‑1854.awsdns‑39.co.uk, and ns‑97.awsdns‑*, consistent with AWS DNS hosting.

No additional public intelligence such as OTX or Safe Browsing entries were identified for this indicator. Given the alignment of the page title, brand targeting, and the observed infrastructure, the domain is deemed a confirmed crypto‑scam infrastructure. Defenders should add the domain and its associated IP address to blocklists, monitor for any re‑activation of the host, and enforce domain‑based filtering for any outbound connections to the listed nameservers. Because the site is currently offline, immediate mitigation focuses on prevention of future resolution and awareness‑raising among users of MetaMask to disregard unsolicited login prompts referencing this URL.