# tranquil-orchid-450400.framer.app — MALICIOUS

> tricol-orchid-450400.framer.app is flagged as a crypto drainer phishing site hitting wallets—18/95 VirusTotal detections warn users immediately.

## Summary
PhishDestroy identifies tranquil-orchid-450400.framer.app as an active crypto drainer posing under a Framer subdomain. The page is engineered to trick cryptocurrency users into signing malicious transactions that silently drain wallet funds, matching known drainer kit behaviors observed in prior takedowns.

Technical indicators confirm elevated threat: VirusTotal reports 18 of 95 engines flagging the domain, the SSL certificate is issued by Let’s Encrypt, and the site resolves to IP 31.43.160.6. The domain currently appears on two public blocklists including OpenPhish and PhishingArmy. Framer.app serves as the registrar and this subdomain was created recently, though exact creation date is redacted in current feeds.

Authorities have flagged the site as high-risk due to crypto-drainer payload delivery, and it remains active at the time of analysis. Immediate blocklisting is recommended for endpoint and network defenses; users should avoid interaction and verify wallet recovery phrases offline. Residual risk persists as the domain may spawn new variants or redirect chains to bypass short-term blocks.

## Threat Details
- Verdict: MALICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: REGISTRAR_NOT_FOUND
- IP: 31.43.160.6

## Detection Status
- VirusTotal: 18 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 2 hits
  Lists: ["OpenPhish", "PhishingArmy"]

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/be1487da-dbaa-48cd-b3d9-721fda3680a2
- PhishDestroy: https://phishdestroy.io/domain/tranquil-orchid-450400.framer.app/
- LLM endpoint: https://phishdestroy.io/domain/tranquil-orchid-450400.framer.app/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/tranquil-orchid-450400.framer.app/
Last updated: 2026-03-27