auth-mitamaskio[.]framer[.]ai

The domain auth-mitamaskio.framer.ai was registered on April 04, 2023 through CSC Corporate Domains, Inc. and resolves to the Amazon Web Services IP address 35.71.142.77 (AS16509, United States). DNS is served by four Route 53 nameservers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns). The site presented a TLS certificate issued by Let’s Encrypt (certificate identifier E8), indicating the use of a free, automated certificate authority. Technical fingerprints show a Framer Sites deployment built on React, with HTTP Strict Transport Security (HSTS) enabled and HTTP/3 support, consistent with modern web‑hosting practices.

Security‑vendor scans on VirusTotal reported that 11 of 93 scanners flagged the domain, reflecting a moderate detection consensus. Google Safe Browsing categorises the URL as a social‑engineering threat, and the domain appears on one external security blocklist. PhishDestroy has also blocked the host. The page title returned by the server is “MetaMask Login – Secure & Easy Web3 Access*”, explicitly referencing the MetaMask brand and indicating a crypto‑scam motive. Current HTTP response is 404 and the site status is listed as offline.

Evidence confirms that the domain is being used to impersonate MetaMask, likely to lure users into entering wallet credentials or seed phrases. However, no direct content beyond the page title has been captured, and no malicious payloads or credential‑harvesting forms have been observed. The exact phishing kit or back‑end infrastructure remains unknown.

Defenders should add auth-mitamaskio.framer.ai to DNS and URL filtering blocks, monitor for new subdomains under framer.ai that reference MetaMask or other Web3 wallets, and incorporate the observed TLS and technology stack into detection rules. Continuous feed updates from VirusTotal, Google Safe Browsing, and PhishDestroy are recommended to capture any re‑activation attempts.