io-metamask-login-eng[.]framer[.]media

This domain, io-metamask-login-eng.framer.media, poses a high-risk threat by impersonating MetaMask to harvest user credentials and sensitive wallet information. The site mimics the official MetaMask login interface, presenting a page titled 'Metamask Login | Getting Started & Secure Device Setup' to deceive visitors into entering their recovery phrases or private keys. Such credential harvesting can lead to unauthorized access to cryptocurrency wallets, resulting in financial loss or identity theft for affected users. Analysis indicates this domain was registered on November 19, 2021, through CSC Corporate Domains, Inc., and currently resolves to the IP address 52.223.52.2, hosted on Amazon Web Services infrastructure in the United States. Security vendors have flagged the domain as malicious, with 13 out of 95 engines on VirusTotal detecting it as a phishing site. Additionally, Google Safe Browsing has classified it as phishing, and it appears on at least one security blocklist, specifically PhishDestroy. The SSL certificate, issued by Let's Encrypt (serial number E7), does not mitigate the risk, as phishing sites commonly use valid certificates to appear legitimate. If you visited io-metamask-login-eng.framer.media or entered any credentials, take immediate action to secure your accounts. Disconnect any connected devices from your MetaMask wallet and revoke access to any suspicious applications through the official MetaMask interface. Change your MetaMask password and generate a new seed phrase if you disclosed it. Monitor your wallet for unauthorized transactions and consider transferring assets to a new wallet if compromise is suspected. Report the incident to MetaMask support and any relevant financial or cybersecurity authorities to assist in tracking the threat.