sso-metamask[.]framer[.]media

The domain sso-metamask.framer.media is actively flagged as a crypto‑related brand‑impersonation campaign targeting MetaMask users. DNS resolution points to the Amazon Web Services address 52.223.52.2, which is registered to AS16509 Amazon.com, Inc. and geolocated to the United States. The site presents an HTTP 404 response with the page title "Site Not Found | Framer", indicating that the web server is currently serving a default error page rather than a phishing login form. The TLS certificate is a Let’s Encrypt issuance (E7), confirming that the domain uses a publicly trusted certificate but does not provide any intrinsic legitimacy.

Registration data shows the domain was created on 19 November 2021 through CSC Corporate Domains, Inc., and the authoritative name servers are ns-1267.awsdns-30.org, ns-1854.awsdns-39.co.uk, ns-535.awsdns-02.net, and ns-97.awsdns-. Technologies identified include Framer Sites, React, HTTP Strict Transport Security, and HTTP/3, all of which are typical of modern web hosting platforms and do not imply malicious intent on their own. The domain appears on one security blocklist and has been blocked by PhishDestroy, demonstrating that at least one external mitigation service has taken action. VirusTotal analysis reports a single positive detection out of ninety‑five scanning engines, suggesting limited but concrete vendor awareness of the malicious nature of the host.

The primary threat vector is a crypto scam that masquerades as MetaMask authentication, though the exact payload or credential‑harvesting mechanisms have not been captured because the site currently returns a 404 page. Defenders should continue to block the domain at perimeter appliances, update URL filtering rules to include the full hostname, and monitor for any future re‑activation of the same IP address or similar subdomains hosted on the same AWS infrastructure.