enter-metamshk-logn--hub[.]framer[.]media

The domain enter-metamshk-logn--hub.framer.media was designed to mimic the official MetaMask wallet login page, tricking users into entering their secret recovery phrase or private keys. Once submitted, the attackers could drain all cryptocurrency from the victim's wallet. This is a classic brand impersonation phishing attack, specifically targeting MetaMask users who may have been lured by fake airdrop promises or urgent security alerts.

PhishDestroy identified this threat through multiple indicators. The domain was created on November 19, 2021, and is registered through CSC Corporate Domains, Inc. VirusTotal analysis shows 10 out of 95 security vendors flagged the domain as malicious, and it appears on at least one security blocklist. The page title was "MetaMask Login Page – Official Wallet Access," and it used a Let's Encrypt SSL certificate (E7) to appear legitimate. The site resolved to IP 35.71.142.77 and has since been taken offline.

If you visited this site and entered any wallet credentials, assume your wallet is compromised. Immediately transfer all assets to a new wallet created on a secure device using a different seed phrase. Never reuse the compromised seed phrase. Always double-check URLs: legitimate MetaMask login is at https://metamask.io or the browser extension. For future protection, use PhishDestroy to verify any link before clicking, and enable hardware wallet security when possible.