metmasksecure[.]framer[.]ai

This report analyzes the domain metmasksecure.framer.ai, which impersonates the MetaMask cryptocurrency wallet brand. The page title, "MetaMask Login - Getting Started with MetaMask@", indicates the site was designed to mimic MetaMask's login interface. The primary threat is credential theft or cryptocurrency asset compromise, as users may be tricked into entering sensitive wallet information.

Technical analysis shows the domain has 9 out of 95 detections on VirusTotal, with flags from ADMINUSLabs, ChainPatrol, alphaMountain.ai, CyRadar, and ESET. It is listed on one blocklist. The domain is registered with CSC Corporate Domains, Inc., and was created on January 6, 2018. It uses an SSL certificate from Let's Encrypt (E8) and is hosted on IP address 35.71.142.77, which belongs to AS16509 (Amazon.com, Inc.) in the United States. Name servers are AWS DNS servers: ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns.

The domain is currently down or offline, which reduces immediate risk. However, based on the impersonation of a well-known brand and the threat type, the risk level is considered high for potential future use. Users should avoid any interaction with this domain.