teal-trip-925578[.]framer[.]app

The domain teal-trip-925578.framer.app was created on October 02, 2020 and is currently listed as taken offline. Registration was performed through CSC Corporate Domains, Inc., and the authoritative nameservers are ns-625.awsdns-14.net, ns-51.awsdns-06.com, ns-1371.awsdns-43.org, and ns-200 (truncated). DNS resolution points to the IP address 52.223.52.2, which belongs to ASN16509 operated by Amazon.com, Inc., and is geolocated in the United States. The site presents an SSL certificate issued by Let’s Encrypt (E7) and supports HSTS and HTTP/3, indicating modern web stack usage. Analysis of the page header returned an HTTP 404 status and the page title "My Framer Site"; no additional content has been captured. Detected technologies include Framer Sites and React, consistent with a template‑based hosting environment.

Threat intelligence flags the domain as a brand‑impersonation vector targeting Microsoft, specifically categorized as a tech support scam. Sixteen of ninety‑three security vendors on VirusTotal flagged the domain, and it appears on a single blocklist operated by PhishDestroy. No further public intelligence sources (e.g., OTX or Safe Browsing) were cited in the available data. The combination of a Microsoft impersonation claim, the tech support scam label, and the presence on a phishing blocklist suggests the domain was used to lure victims into fraudulent support interactions, though the exact payload or credential‑harvesting mechanism has not been observed.

Defenders should add teal‑trip‑925578.framer.app to inbound and outbound web filtering rules, monitor DNS queries for the associated nameservers and IP address, and enforce TLS inspection to verify the Let’s Encrypt certificate chain. Given the domain’s offline status, ongoing surveillance is recommended to detect any re‑registration or replica deployments that might reuse the same brand‑impersonation tactics.