neat-retention-846400[.]framer[.]app

This report documents the domain neat-retention-846400.framer.app, a Framer-hosted site identified as part of a generic phishing infrastructure. The domain was registered on June 20, 2026, and has since been taken offline as of the report date, July 24, 2026. Infrastructure analysis reveals the domain resolved to the IP address 31.43.161.6, hosted on Amazon.com, Inc. infrastructure (AS16509) located in the Netherlands. The site returned an HTTP 404 status at the time of assessment, indicating it was no longer serving active content.

A Let's Encrypt SSL certificate (serial number YE1) was in use, and the site employed technologies including Framer Sites, React, HSTS, and HTTP/3. Detection data from security vendors indicates elevated risk: 17 of 91 vendors on VirusTotal flagged the domain as malicious, and it appears on at least one security blocklist, specifically PhishDestroy. The page title, 'My Framer Site,' provides no conclusive evidence of a targeted brand or specific phishing campaign, and no additional scam classification or brand impersonation details are available from the provided intelligence. The domain was registered through Framer, and no nameservers were detected at the time of analysis.

While the domain is currently offline, its prior hosting on a legitimate platform (Framer) and detection by multiple security vendors suggest it was actively used for phishing. Defenders should monitor for reactivation or similar domains leveraging Framer’s infrastructure. Historical DNS and SSL certificate logs may provide additional context for tracking related activity. No further details about the phishing kit, target, or campaign are available at this time.