busy-photos-088208[.]framer[.]app

Analysis of busy-photos-088208.framer.app indicates that the domain was provisioned through the Framer hosting platform and resolves to IP address 31.43.161.6, which is geolocated to the Netherlands and associated with Framer B.V. The site presented a page title of “Swisscom Login”, aligning with the listed scam type of credential phishing. The TLS certificate is issued by Let’s Encrypt (certificate identifier YE1), and the server advertised HSTS and HTTP/3 support, while the HTTP response returned a 404 status code at the time of collection. The domain was listed on a single security blocklist and is explicitly blocked by the PhishDestroy service.

VirusTotal records show that the domain was examined by 91 scanning engines, none of which reported a detection at the time of analysis. Nameserver information could not be retrieved, and the domain is currently taken offline, limiting immediate observation of malicious payloads. The limited visibility means that the exact content and any embedded scripts remain unverified, and no additional indicators such as malicious URLs or file hashes have been released.

Defenders should continue to monitor DNS queries for the IP 31.43.161.6 and the domain itself, enforce blocklisting in web filtering solutions, and treat any login attempts to “Swisscom” originating from this host as suspicious. Because the infrastructure is hosted on a legitimate SaaS provider, threat actors may rapidly redeploy similar clones, so periodic re‑resolution and re‑scanning of the domain are advised. Coordination with the hosting provider and blocklist operators can facilitate takedown if the site reappears.