page-metasklog-web[.]framer[.]ai

Analysis of page-metasklog-web.framer.ai indicates that the domain is being used for brand impersonation targeting MetaMask users. The site presents the page title “Sign In to METAMASK | Trusted Crypto Trading Platform,” which aligns with the declared scam type of a crypto scam. The domain resolves to the Amazon Web Services IP address 35.71.142.77, located in the United States and announced as belonging to AS16509 (Amazon.com, Inc.). The hosting provider and the nameserver set—ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns—are typical of AWS‑hosted infrastructure. The SSL certificate is issued by Let’s Encrypt (E8), and the site enforces HSTS and HTTP/3, indicating a modern web stack built on Framer Sites and React.

An HTTP request now returns a 404 status, and the domain has been taken offline, which is reflected in the current status flag. The registrar listed is CSC Corporate Domains, Inc., and the domain was originally created on 06 January 2018, suggesting the infrastructure may have been repurposed for the current campaign. Threat intelligence feeds show that 10 of 95 VirusTotal scanners flagged the domain, and it appears on a single external blocklist. PhishDestroy has already blocked the domain, providing additional corroboration of malicious intent.

The combination of brand impersonation, a convincing page title, and the presence of a crypto‑related scam label supports the classification as a high‑confidence crypto phishing site. Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms, as no page content has been captured beyond the title. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurgence of the host, and update detection rules to include the observed TLS fingerprint and the specific nameserver set.