seacure-mettamask--logn[.]framer[.]media

The domain seacure-mettamask--logn.framer.media was registered on November 19, 2021 through CSC Corporate Domains, Inc. and is served by the AWS nameservers ns-1267.awsdns-30.org, ns-1854.awsdns-39.co.uk, ns-535.awsdns-02.net, and ns-97.awsdns-. The site resolves to the IP address 35.71.142.77, an Amazon.com, Inc. address located in the United States and belonging to ASN 16509. A Let’s Encrypt certificate is present, indicating HTTPS support, and the infrastructure reports use of Framer Sites, React, HSTS, and HTTP/3. The HTTP response returned a 404 status, and the domain has been taken offline.

The page title collected from prior snapshots reads “MetaMask Login | Secure Access to Your Crypto Wallet,” directly referencing the MetaMask brand and indicating a crypto‑related impersonation campaign. VirusTotal scans show that ten of ninety‑five security vendors flagged the domain, and it is listed on one external blocklist. PhishDestroy has also blocked the domain. The evidence points to a brand‑impersonation scam targeting MetaMask users, likely intended to harvest credentials for crypto wallets.

Uncertainties remain regarding any malicious payload or credential‑harvesting form because the page content has not been captured beyond the title. Defenders should add the domain and its associated IP address to web‑filter and DNS‑sinkhole lists, monitor outbound connections to the AWS range for similar activity, and flag any traffic that attempts TLS handshakes to the listed Let’s Encrypt certificate. Continuous observation of new sub‑domains under framer.media and rapid re‑evaluation of any re‑activations are recommended to prevent re‑use of the same impersonation pattern.