metamsk[.]framer[.]ai

The domain metamsk.framer.ai was observed as offline at the time of analysis on July 24, 2026, but historical data provides a clear infrastructure picture. DNS resolution returned the address 52.223.52.2, an Amazon Web Services host located in the United States and belonging to ASN 16509 (Amazon.com, Inc.). Registration records show the domain was created on January 06, 2018 and was registered through CSC Corporate Domains, Inc., using the nameservers ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns. The site presented a TLS certificate issued by Let’s Encrypt (certificate identifier E8), indicating a valid HTTPS endpoint at the time of capture.

The HTTP response code was 404, and the page title extracted from the site was “Login to MetaMask – Secure Wallet Access Made Easy,” directly referencing the MetaMask brand. Technology fingerprints identified Framer Sites, React, HSTS, and HTTP/3, consistent with a modern web stack often leveraged for credential‑stealing pages. VirusTotal scans recorded eight detections out of ninety‑five security vendors, and the domain is listed on a single external blocklist. PhishDestroy also flagged the site.

No additional content analysis is available because the site is currently offline, leaving the exact page layout and user‑interaction details unknown. Defenders should continue to block the resolved IP address and the domain itself, monitor for any re‑registration attempts, and incorporate the domain into brand‑monitoring feeds. Given the observed detection rate and the explicit brand‑impersonation page title, the threat level remains elevated, and remediation actions should include updating web‑filter rules, informing affected users of potential credential exposure, and reviewing any credential‑reuse patterns associated with MetaMask services.