user-en-ext-cdn[.]framer[.]ai

Analysis of user-en-ext-cdn.framer.ai, flagged as a generic phishing domain, shows a modest but notable malicious profile. The domain was registered on April 04, 2023 through CSC Corporate Domains, Inc., and it is served from Amazon’s cloud infrastructure (IP 35.71.142.77, ASN 16509). The name servers – ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns – are all native to Amazon Route 53, confirming the reliance on AWS services. A Lets Encrypt/E8 certificate secures HTTPS traffic, while the site advertises HSTS and HTTP/3 support, indicating a modern TLS configuration that can aid evasion of legacy security tools.

Threat intelligence from VirusTotal records nine of ninety‑three scanning engines flagging the domain, providing a modest confidence level that the host is associated with malicious activity. The domain appears on a single external blocklist and is explicitly blocked by PhishDestroy, reinforcing the consensus that it is being used for phishing attempts. The HTTP response is currently a 404 status with the page title “Site Not Found | Framer,” suggesting that the phishing host has been taken offline or is in a transitional state.

Infrastructure observations show no additional hosting or CDN layers beyond the primary AWS endpoint, and there is no evidence of compromised third‑party services. The site’s technology stack, identified as Framer Sites built on React, aligns with the legitimate Framer platform, which may be leveraged to lend credibility to phishing pages. No further information on the specific payload or targeted brand is available.

Given the existing detections and blocklist entries, security teams should continue to deny connections to user-en-ext-cdn.framer.ai at both network and endpoint layers. Monitoring of DNS queries for the domain and its associated name servers is advisable to detect any re‑activation.