setamaskk[.]framer[.]ai

Analysis of the domain setamaskk.framer.ai indicates it was involved in a wallet-seed phishing campaign targeting MetaMask users. The domain was registered on April 4, 2023, through CSC Corporate Domains, Inc., and resolved to the IP address 52.223.52.2, hosted on Amazon Web Services (AS16509) in the United States. Nameservers associated with the domain include ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns, further linking it to AWS infrastructure. The SSL certificate was issued by Let's Encrypt, a common choice for both legitimate and malicious domains.

At the time of assessment, the domain returned an HTTP 404 status with the page title 'Site Not Found | Framer,' suggesting it was either taken offline or reconfigured. Despite this, six out of ninety-five security vendors on VirusTotal flagged the domain as malicious, and it appeared on at least one security blocklist, specifically PhishDestroy. The combination of brand impersonation (MetaMask), the use of a hosting provider frequently leveraged for phishing, and detection by multiple security vendors supports the classification of this domain as part of a seed-phishing operation. Defenders should treat this domain as compromised infrastructure.

While it is currently offline, historical resolution to 52.223.52.2 and its registration details may still be useful for retrospective threat hunting. Organizations are advised to block the domain at the DNS level and monitor for any re-emergence or related domains using similar naming conventions or infrastructure. The exact content of the phishing page is not analyzed in this report, but the available evidence aligns with known patterns of cryptocurrency wallet seed-phishing campaigns.