weekly-cogwheel-356661[.]framer[.]app

The domain weekly-cogwheel-356661.framer.app resolves to the IP address 52.223.52.2, which belongs to ASN 16509 operated by Amazon.com, Inc., and is geolocated in the United States. Registration records show the domain was created on 02 October 2020 through CSC Corporate Domains, Inc., and is served by the AWS name servers ns-1371.awsdns-43.org, ns-2002.awsdns-58.co.uk, ns-51.awsdns-06.com, and ns-625.awsdns-. The site presented an HTTP 404 status and a page title of “My Framer Site” before being taken offline.

TLS inspection indicates a Let’s Encrypt certificate (issuer E7) with HSTS and HTTP/3 enabled, and the underlying stack includes Framer Sites and React components. Threat intelligence flags the domain as a generic phishing vector; it appears on one security blocklist and is specifically blocked by PhishDestroy. VirusTotal analysis shows 15 of 93 scanning engines flagged the domain, reinforcing the malicious classification.

Current observations are limited to infrastructure and certificate data because the content is no longer accessible. Defenders should continue to enforce blocking of the IP 52.223.52.2 and the domain across perimeter controls, add the domain to internal threat feeds, and monitor the associated AWS name servers for any re‑use. Ongoing vigilance is advised in case the infrastructure is repurposed for new phishing campaigns, given the persistent hosting environment and valid TLS configuration.