secure-matamask-en-public[.]framer[.]media

Analysis of secure-matamask-en-public.framer.media, observed on July 24, 2026, confirms the site was operated as a brand‑impersonation campaign targeting MetaMask users. The domain, registered on November 19, 2021 through CSC Corporate Domains, Inc., resolves to the Amazon‑hosted IP address 35.71.142.77, an AS16509 allocation located in the United States. Technical fingerprinting identified the use of Framer Sites, React, HSTS, and HTTP/3, indicating a modern web stack typical of fast‑deployment phishing kits. The TLS certificate is issued by Let’s Encrypt (E7) and matches the domain name, providing no indication of certificate misuse.

The page title returned by the server is "Log In | MetaMask*", directly referencing the MetaMask brand and supporting the claim of brand impersonation. HTTP probing yielded a 404 status, and the site has since been taken offline, a state corroborated by the PhishDestroy blocklist entry that currently lists the domain as blocked. VirusTotal scans show a single detection out of 93 security vendors, and the domain appears on one additional security blocklist, reinforcing its malicious classification despite the low detection count. Nameserver configuration includes four AWS Route 53 servers (ns-1267.awsdns-30.org, ns-1854.awsdns-39.co.uk, ns-535.awsdns-02.net, ns-97.awsdns-).

No further indicators such as payload URLs, credential harvesting endpoints, or additional infrastructure have been disclosed. Defenders should add the domain and its associated IP address to blocklists, monitor for any re‑registration attempts, and enforce strict URL filtering for any traffic to framer.media subdomains that reference MetaMask. Users should be warned that legitimate MetaMask services never use Framer‑hosted domains for login flows, and any unsolicited prompts to "Log In" on such URLs should be treated as fraudulent.