homely-attributes-155419[.]framer[.]app

This domain, homely-attributes-155419.framer.app, is flagged as a high-risk credential theft scam. The site was designed to trick users into submitting sensitive information, such as usernames and passwords, which could be used for unauthorized access to accounts or further malicious activities. The domain's infrastructure and online reputation suggest it was part of a sophisticated phishing campaign targeting unsuspecting users.

Analysis indicates that 21 out of 95 security vendors on VirusTotal have flagged this domain as malicious. The domain was registered through Framer, a popular web design and prototyping platform, which may have been abused to host the phishing site. The domain appears on three security blocklists: PhishDestroy, PhishingArmy, and OISD. Despite these red flags, the site currently resolves to the IP address 31.43.160.6 and has been taken offline. The use of technologies like Framer Sites, React, and HTTP/3 suggests a modern and potentially convincing web presence. The domain also supports HSTS and has an SSL certificate issued by Let's Encrypt, which could further lull users into a false sense of security.

If users have visited homely-attributes-155419.framer.app, they should immediately change passwords for any accounts they may have entered credentials into on the site. It is advisable to monitor account activity for any unauthorized access or suspicious behavior. Users should also run a comprehensive scan on their devices to ensure no malware was installed. Reporting the incident to relevant security teams and informing any potentially affected parties is recommended to mitigate the impact of the credential theft scam.