portfolio-metamssio-cdn[.]framer[.]ai

The domain portfolio-metamssio-cdn.framer.ai is a phishing site engaged in brand impersonation targeting MetaMask, a cryptocurrency wallet platform. It presents itself as a legitimate MetaMask login page to deceive users into entering credentials or sensitive information, posing an elevated risk of cryptocurrency theft. No drainer kit was identified, but the site was actively used for credential phishing before being taken offline.

Technical analysis shows portfolio-metamssio-cdn.framer.ai was flagged by 13 of 95 VirusTotal security vendors, including ChainPatrol, alphaMountain.ai, and CRDF. It appears on one security blocklist (PhishDestroy) but was not flagged by Google Safe Browsing. The domain was registered through CSC Corporate Domains, Inc. on January 6, 2018, and resolves to IP address 52.223.52.2, hosted on Amazon.com, Inc. (AS16509) in the US. The SSL certificate was issued by Let's Encrypt (E8), and the observed page title was 'MetaMask Login : The Leading Crypto Wallet Platform'. Technologies detected include Framer Sites, React, HSTS, and HTTP/3. The domain currently returns a 404 HTTP status.

Users who interacted with portfolio-metamssio-cdn.framer.ai should immediately change their MetaMask credentials and enable two-factor authentication (2FA) on all accounts. Monitor financial and cryptocurrency accounts for unauthorized transactions and consider revoking any token approvals granted during the suspected compromise. Report the phishing domain to MetaMask support, the hosting provider (Framer), and platforms like Google Safe Browsing or PhishTank to aid in takedown efforts.