brainy-core-176300[.]framer[.]app

This domain, brainy-core-176300.framer.app, is identified as a credential harvesting phishing portal designed to mimic a legitimate authentication interface. The page title, 'Sign In to Get Started,' suggests an intent to deceive users into submitting sensitive login credentials, likely targeting corporate or personal accounts. Analysis indicates the domain was crafted to exploit trust in commonly used login workflows, potentially leading to unauthorized account access or further social engineering attacks. Infrastructure analysis reveals the domain is hosted on an IP address, 31.43.161.6, located in the Netherlands under AS16509, associated with a major cloud provider. The domain is registered through Framer, a platform often used for web development and hosting. Security vendor detections on VirusTotal report 18 out of 95 engines flagging the domain as malicious, while it appears on one additional security blocklist. The SSL certificate is issued by Let's Encrypt, a common certificate authority, which does not inherently indicate legitimacy due to its widespread use in both benign and malicious domains. Users who have interacted with this domain should immediately terminate any active sessions and refrain from entering credentials. If login details were submitted, affected accounts should be secured by changing passwords and enabling multi-factor authentication where available. System administrators are advised to block the domain and associated IP address, 31.43.161.6, at the network level to prevent further exposure. Monitoring for unusual account activity and reviewing connected devices for unauthorized access is strongly recommended.