whole-company-325511[.]framer[.]app

PhishDestroy identifies whole-company-325511.framer.app as an active credential theft domain currently distributing malicious content designed to harvest user credentials. This domain is confirmed to be engaged in credential theft activities, posing an elevated risk to unsuspecting visitors. The infrastructure behind this domain is actively operational and has been observed distributing fraudulent login forms mimicking legitimate corporate platforms.

This domain was flagged by 22 of 95 VirusTotal security vendors, indicating significant malicious activity detection. The domain resolves to IP address 31.43.160.6 and utilizes a Let's Encrypt SSL certificate for deceptive legitimacy. The domain is associated with the Framer platform but has been weaponized to facilitate credential harvesting. It has been confirmed to appear on 2 active phishing blocklists, including OpenPhish and PhishingArmy, demonstrating cross-platform threat intelligence coverage. The current status is classified as active with a unique seed identifier of ab74a2.

Current status indicates this credential theft domain remains active and poses an ongoing threat to end users. PhishDestroy recommends immediate avoidance of this domain and any associated links or embedded content. Users who may have interacted with this domain should assume credential compromise and initiate password resets for all affected accounts. Additionally, organizations should consider blocking this domain at the network perimeter using the provided IP address and domain name indicators. Continuous monitoring for credential harvesting attempts and user awareness training are strongly advised to mitigate the risk of credential theft operations.