metamasck-divace[.]framer[.]media

Analysis of metamasck-divace.framer.media indicates this domain was actively impersonating MetaMask, a cryptocurrency wallet service, as part of a crypto scam operation. The domain was registered on November 19, 2021, through CSC Corporate Domains, Inc., and resolved to IP address 35.71.142.77, hosted on Amazon Web Services (AS16509) in the United States. The page title, 'Login: | MetaMask App,' directly references the MetaMask brand, confirming the impersonation intent. SSL certification was provided by Let's Encrypt (E7), a common choice for both legitimate and malicious sites. As of the report date, the domain returns an HTTP 404 status, suggesting it has been taken offline or disabled.

Infrastructure analysis reveals the use of Framer Sites and React, technologies often employed for rapid deployment of phishing pages. The domain appeared on one security blocklist and was flagged by PhishDestroy. Sixteen of 93 security vendors on VirusTotal detected the domain as malicious, though this does not represent a comprehensive assessment of its threat status. Nameservers associated with AWS (ns-1267.awsdns-30.org, ns-1854.awsdns-39.co.uk, ns-535.awsdns-02.net, and ns-97.awsdns) were used, consistent with cloud-based hosting common in phishing campaigns. Defenders should treat this domain as confirmed malicious infrastructure.

While currently offline, the domain may reappear under different hosting or with altered content. Network security teams are advised to block access to the domain and its associated IP address. Historical DNS and SSL certificate records should be reviewed for potential reuse patterns. Given the domain's age and prior activity, monitoring for renewed registration or DNS changes is recommended. No evidence of active exploitation was observed at the time of this report, but the domain's history and technical indicators align with known crypto scam tactics.