artsy-illustrations-984670[.]framer[.]app

Analysis of the domain artsy-illustrations-984670.framer.app indicates active phishing infrastructure targeting users of design or creative platforms. The domain, registered through Framer B.V., currently resolves to IP address 31.43.160.6 and remains operational as of August 01, 2026, despite being flagged by 18 of 91 security vendors on VirusTotal and listed on two security blocklists, including PhishDestroy and OpenPhish. Infrastructure checks reveal a critical anomaly: the domain returns NS_NOT_FOUND for nameservers, suggesting either misconfiguration or deliberate evasion of standard DNS resolution processes. This absence of valid nameservers is atypical for legitimate services hosted on Framer’s platform, where DNS records are normally provisioned automatically.

The domain’s hosting on Framer’s infrastructure may provide a veneer of legitimacy, as Framer is a known platform for web design and prototyping. However, the combination of unresolved nameservers, active blocklist presence, and vendor detections strongly supports classification as malicious. No specific brand impersonation details or page content analysis are available in the current evidence, so the exact nature of the phishing lure—whether credential harvesting, payment fraud, or another scheme—remains unconfirmed.

Defenders should treat this domain as high-risk and prioritize blocking at DNS, network, and endpoint layers. Security teams are advised to monitor for connections to 31.43.160.6 and review logs for any user interactions with artsy-illustrations-984670.framer.app, particularly in environments where design tools or creative software are in use. Further investigation into the site’s content and backend infrastructure is recommended to determine the full scope of the threat.