diverse-variation-966200[.]framer[.]app

This domain, diverse-variation-966200.framer.app, is flagged as a credential harvesting phishing site with an elevated risk level. The infrastructure is designed to deceive users into submitting sensitive login credentials, likely targeting corporate or financial account holders. The use of a legitimate-looking subdomain under framer.app, combined with a generic page title (My Framer Site), suggests an attempt to mimic authentic services while evading detection through low-profile hosting. Analysis indicates the domain was registered on February 21, 2026, through CSC Corporate Domains, Inc., and resolves to the IP address 35.71.142.77, hosted on Amazon Web Services (AS16509). Security vendors on VirusTotal flagged the domain in 20 out of 95 scans, while it appears on one security blocklist. The SSL certificate is issued by Let's Encrypt (serial number E7), a common tactic to lend false legitimacy. The domain has since been taken offline, but historical records confirm its prior malicious activity. The combination of a recent creation date, low detection rates, and cloud-based hosting aligns with common phishing infrastructure patterns. Mitigation for this threat type involves immediate blocklisting of the domain and associated IP across network security controls. Organizations should monitor for user interactions with the domain in logs, particularly authentication attempts or form submissions. Security teams are advised to review SSL certificate transparency logs for similar Let's Encrypt-issued certificates tied to framer.app subdomains. User awareness training should emphasize scrutinizing subdomains and page titles, even when hosted on seemingly legitimate platforms. If credentials were exposed, affected accounts must be locked, passwords reset, and multi-factor authentication enforced.