joyous-course-233115[.]framer[.]app

Analysis of joyous-course-233115.framer.app shows a short‑lived infrastructure designed for credential harvesting. The domain was created on March 11, 2026 and is registered through the Framer platform, which is also identified as the technology stack (Framer Sites, React) serving the site. An SSL certificate issued by Let’s Encrypt (E7) is present, and the server advertises HSTS and HTTP/3, indicating a modern web configuration. DNS resolution points to IP address 31.43.160.6, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the Netherlands.

The HTTP response for the hosted page is a 404 status, and the page title reported by scanners is "Xfinity Sign In," suggesting the campaign targets Comcast Xfinity credentials. Security telemetry shows the domain appears on one blocklist and is explicitly blocked by PhishDestroy. VirusTotal has recorded 13 detections out of 95 scanned vendors, reinforcing the malicious classification. The threat is labeled as Credential Phishing, aligning with the page title that references a legitimate service login.

Current status is offline, but the observed indicators—recent registration, cloud hosting, valid TLS, and detection by multiple vendors—provide a clear pattern for defenders. Uncertainty remains around the exact content served before takedown, as the 404 response limits visibility into the phishing payload. Defensive actions should include adding the domain and its resolving IP to blocklists, monitoring for other Framer‑based domains created after March 2026, and enabling URL filtering for Xfinity‑related keywords. Continuous re‑scanning of the IP range is advised to detect any re‑use of the same hosting infrastructure for future campaigns.