webmail-earthlink-net-newmessage[.]framer[.]website

The domain webmail-earthlink-net-newmessage.framer.website is currently active and classified as a generic phishing campaign with an elevated risk rating. Infrastructure analysis shows that the domain resolves to the IP address 31.43.161.6, which is the sole host observed for this indicator. Registration metadata indicates the domain was created through the Framer registration service, suggesting the attacker leveraged a legitimate web‑design platform to obtain a subdomain under the framer.website namespace. Threat intelligence platforms have recorded 17 of 91 security vendors flagging the domain on VirusTotal, reflecting a moderate level of detection across the ecosystem.

Additionally, the domain is listed on one external security blocklist, and it has been explicitly blocked by the PhishDestroy filtering service. No public SSL certificate details, HTTP response codes, or page‑title information are available at this time, limiting the depth of observable surface‑web characteristics. The lack of further contextual data such as brand targeting or page content means the precise lure employed by the campaign remains uncertain.

Defenders should prioritize immediate containment actions: add the domain and its resolving IP address to network‑level deny lists, update intrusion‑prevention signatures, and ensure that email gateways enforce strict URL filtering for the framer.website suffix. Continuous monitoring of the IP 31.43.161.6 for additional malicious activity is advised, as is periodic re‑query of reputation services to capture any changes in detection counts or blocklist status. Organizations should also consider sharing observables with threat‑intel sharing communities to accelerate collective mitigation of this active phishing infrastructure.