grateful-path-345786[.]framer[.]app

The domain grateful-path-345786.framer.app has been identified as a credential theft operation, designed to harvest user login credentials through deceptive web pages. At the time of analysis, the domain is reported as offline, though prior activity indicates a high-risk threat profile. No specific brand impersonation has been confirmed, but the infrastructure aligns with known credential harvesting tactics. Infrastructure analysis reveals the domain was hosted on IP address 31.43.160.6 and registered through Framer, a legitimate site-building platform. The domain is flagged by 16 of 95 security vendors on VirusTotal, with detections from multiple blocklists, including PhishDestroy, PhishingArmy, and OISD. Technologies detected include Framer Sites, React, HSTS, and HTTP/3, suggesting a modern, potentially evasive phishing framework. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious domains due to its accessibility. The page title, 'My Framer Site,' provides no immediate indication of brand impersonation but aligns with generic phishing templates. Current status indicates the domain has been taken offline, likely in response to detection and reporting. However, the infrastructure remains a potential risk for re-deployment under a new domain or subdomain. Organizations and users are advised to block the domain and associated IP address (31.43.160.6) at the network level. Security teams should monitor for similar patterns, including domains hosted on Framer or other site-building platforms, particularly those using Let’s Encrypt certificates and modern web technologies like React and HTTP/3. End-users should be educated on recognizing credential theft attempts, particularly those leveraging seemingly benign page titles and legitimate-looking infrastructure.