blissful-platforms-135005[.]framer[.]app

The domain blissful-platforms-135005.framer.app has been identified as a high-risk phishing resource targeting users of the Framer platform. Analysis indicates this domain was actively impersonating Framer, a legitimate web design and publishing service, to deceive visitors into disclosing sensitive credentials or installing malicious payloads. As of the latest assessment, the domain has been taken offline, though prior activity remains a documented security concern. Infrastructure analysis reveals the domain was registered through CSC Corporate Domains, Inc. on February 21, 2026, an unusually forward-dated creation that may indicate domain pre-positioning for future malicious campaigns. The domain resolved to the IP address 31.43.160.6, hosted within the Netherlands under Amazon.com, Inc.'s AS16509 autonomous system. Detection metrics show 17 of 95 security vendors on VirusTotal flagged this domain as malicious, while it appeared on at least one security blocklist. The SSL certificate was issued by Let's Encrypt with serial number E7, a common certificate authority often exploited by threat actors due to its accessibility and automation capabilities. Google Safe Browsing previously classified this domain as a phishing threat, and the page title, 'Site Not Found | Framer,' suggests an attempt to mimic legitimate error pages to avoid immediate suspicion. While the domain is currently offline, the technical indicators associated with blissful-platforms-135005.framer.app warrant continued monitoring. Organizations and users are advised to update security controls to block the domain and its associated IP address, 31.43.160.6, at the network perimeter. Security teams should review logs for connections to this domain or IP, particularly those occurring prior to its takedown. Given the domain's registration through a corporate registrar and its use of a legitimate SSL provider, additional scrutiny of similarly structured domains is recommended. Users who may have interacted with this domain should reset credentials for any accounts accessed during the exposure window and enable multi-factor authentication where available.