mtask-log-auth[.]framer[.]media

This domain, mtask-log-auth.framer.media, is flagged for brand impersonation targeting MetaMask, a cryptocurrency wallet service. Analysis indicates the domain was registered on November 19, 2021, through CSC Corporate Domains, Inc., and currently resolves to IP 35.71.142.77, hosted on Amazon Web Services (AS16509, US). The SSL certificate is issued by Let's Encrypt (serial E7), and the site employs technologies including Framer Sites, React, HSTS, and HTTP/3. The page title, 'Log-in | MetaMask Developer,' directly references the targeted brand, confirming the intent to mimic MetaMask's authentication portal.

As of July 22, 2026, the domain returns an HTTP 404 status, suggesting it has been taken offline or is no longer serving content. It appears on one security blocklist, and two of 95 security vendors on VirusTotal flagged it as malicious. Nameservers are hosted under AWS DNS (awsdns-39.co.uk, awsdns-30.org, awsdns-02.net, and awsdns-49.com). The scam type is classified as a crypto scam, though specific attack vectors (e.g., credential harvesting, wallet drainers) are not confirmed in available data.

Defenders should treat this domain as high-risk infrastructure, particularly for MetaMask users. Recommended actions include blocking the domain and IP at perimeter controls, monitoring for related subdomains or newly registered lookalike domains, and correlating logs for prior connections to 35.71.142.77. While the domain is offline, historical DNS and WHOIS records should be preserved for forensic analysis if related incidents are reported.