smooth-fancy-548383[.]framer[.]app

This domain is flagged as a high‑risk generic phishing infrastructure. The fully qualified name smooth-fancy-548383.framer.app resolves to the IPv4 address 31.43.161.6. Registration data show the domain was created through Framer B.V., a legitimate provider of web‑hosting services, but the registrar information does not hide the association with the Framer platform. No public nameserver records are returned (NS_NOT_FOUND), which limits visibility into DNS delegation. The domain appears on two reputable security blocklists and is actively listed by PhishDestroy and OpenPhish, confirming that at least two independent anti‑phishing feeds have observed malicious activity tied to this host.

VirusTotal has recorded 17 positive detections out of 91 submitted scanners, indicating that a notable subset of commercial security engines consider the site malicious. The current operational status is reported as active, meaning the infrastructure is still reachable. Publicly available intelligence does not include a TLS certificate, HTTP response codes, page title, or any documented payload. Consequently, the exact content served by the site remains unknown, and attribution to a specific phishing kit or targeted brand cannot be confirmed.

The lack of visible SSL information also prevents assessment of certificate trust scores. Defenders should treat any traffic to or from 31.43.161.6 that includes the host smooth-fancy-548383.framer.app as suspicious. Recommended actions include blocking the domain at DNS and proxy layers, adding the IP address to network‑level deny lists, and monitoring outbound connections for beaconing to this host. Continuous re‑evaluation is advised, as the threat actor may modify the underlying content or shift hosting while retaining the same domain.