common-company-348799[.]framer[.]app

The domain common-company-348799.framer.app is flagged as a fake login portal designed to harvest credentials. Analysis indicates the domain is currently offline, though prior activity suggests it impersonated a legitimate service to deceive users into submitting authentication details. No specific brand impersonation was confirmed, but the infrastructure aligns with credential theft campaigns. Infrastructure analysis reveals the domain was registered on February 21, 2026, through CSC Corporate Domains, Inc., and resolves to the IP address 52.223.52.2, hosted on Amazon.com, Inc. (AS16509) in the United States. Security vendors flagged the domain in 20 of 95 VirusTotal scans, with detection labels including phishing and malicious content. The domain appears on one security blocklist, and Google Safe Browsing explicitly flags it as a phishing threat. The SSL certificate, issued by Let's Encrypt (serial number E7), does not mitigate the risk, as phishing domains frequently use valid certificates to appear legitimate. The domain is currently offline, but residual risk remains due to potential reuse or reactivation. Organizations should add the domain and associated IP (52.223.52.2) to network blocklists to prevent access. Security teams are advised to monitor for related subdomains or newly registered lookalike domains under the same registrar. End users who may have interacted with the domain should reset credentials and enable multi-factor authentication on critical accounts. Historical WHOIS data and SSL certificate details should be preserved for forensic analysis if further incidents arise.