pretty-aspects-327675[.]framer[.]app

Analysis indicates that the domain pretty-aspects-327675.framer.app is actively used in a generic phishing campaign and remains listed on multiple threat intelligence feeds. The domain has been blocked by both PhishDestroy and OpenPhish and appears on two additional security blocklists, confirming its malicious reputation. VirusTotal reports that 15 of 91 security vendors have flagged the domain, reinforcing the consensus that the site is malicious. Infrastructure examination shows the domain resolves to the IP address 31.43.160.6.

The IP is associated with Framer B.V., the registrar listed for the domain, suggesting the hosting environment is provided by Framer’s cloud services. No nameserver records were returned, indicating possible misconfiguration or deliberate obfuscation of DNS infrastructure. The domain’s registration details are limited to the registrar information; no further WHOIS metadata such as creation or expiration dates were disclosed. There is no available data on SSL/TLS deployment, HTTP response codes, page title, or content analysis, so the exact credential‑stealing mechanisms employed by the site remain undocumented.

Defenders should add the domain and its resolving IP to network‑level deny lists, enforce DNS filtering that includes the known blocklists, and monitor for any traffic to 31.43.160.6 originating from internal hosts. Continuous re‑scanning with multi‑vendor engines is advised to capture any evolution of the malicious payload. Organizations should also consider broader threat‑intel feeds to capture related indicators that may emerge as the campaign expands.