invisible-yards-324092[.]framer[.]app

This domain, invisible-yards-324092.framer.app, is identified as a crypto drainer phishing site designed to harvest wallet credentials. Analysis indicates the page impersonates legitimate Framer services to deceive users into connecting cryptocurrency wallets, enabling unauthorized fund transfers. The domain is currently offline, but prior activity suggests it was actively targeting users during its operational period. Infrastructure analysis reveals the domain was flagged by 3 of 95 security vendors on VirusTotal, with a registrar affiliation to Framer. It resolved to the IP address 31.43.160.6 and was listed on three security blocklists. The SSL certificate was issued by Let's Encrypt, and the site employed technologies including React, HSTS, and HTTP/3. The page title, 'My Framer Site,' aligns with generic templates often exploited for phishing campaigns. No specific creation date was provided, but the domain's rapid takedown suggests it was short-lived. The risk level for this domain is classified as elevated due to its direct targeting of cryptocurrency assets. Organizations and users are advised to block the domain and associated IP at the network level. Wallet holders should verify transaction histories for unauthorized activity and revoke any suspicious wallet connections. Security teams should monitor for similar domains registered through Framer or other site-building platforms, particularly those using generic page titles or resolving to the same IP range. Indicators of compromise include the domain name, IP address 31.43.160.6, and the unique seed bd284e for correlation in logs.