unusual-alpaca-535612[.]framer[.]app

This domain, unusual-alpaca-535612.framer.app, is flagged as an elevated-risk phishing site specializing in AR24-themed credential harvesting. The page title, 'Lettre recommandée - AR24,' mimics legitimate registered mail notifications, a tactic commonly used to exploit recipients expecting official correspondence. Analysis indicates this infrastructure was designed to deceive users into divulging sensitive information under the guise of a trusted postal service. Infrastructure analysis reveals the domain was registered through Framer and is currently offline. Security vendors on VirusTotal flagged the domain at a 20/95 detection rate, with one entry on a security blocklist. The site resolved to IP address 31.43.161.6, hosted on Amazon.com, Inc. infrastructure (AS16509) in the Netherlands. The SSL certificate was issued by Let's Encrypt (YE1), a common choice for both legitimate and malicious sites due to its accessibility. The domain was blocked by at least one security filter, further confirming its malicious intent. Mitigation for AR24-themed phishing requires heightened scrutiny of unexpected registered mail notifications. Users should verify the sender’s domain independently, avoiding links embedded in emails or messages. Organizations should implement email filtering rules to quarantine messages containing 'Lettre recommandée' or 'AR24' from non-official domains. Network-level protections, such as blocking the resolved IP (31.43.161.6) and monitoring for Let's Encrypt certificates tied to newly registered Framer domains, can reduce exposure. Security teams should prioritize user education on recognizing phishing lures that exploit trusted service branding.