green-keep-648502[.]framer[.]app

This domain, green-keep-648502.framer.app, was registered through Framer on 29 April 2026 and resolves to the IPv4 address 31.43.161.6 located in the Netherlands, attributed to Framer B.V. The host presents an HTTP 404 response and serves a TLS certificate issued by Let’s Encrypt (certificate identifier E8). The page title returned by the server is “Xfinity Sign In”, indicating an attempt to harvest credentials for the Xfinity service. Analysis from Gridinsoft rates the domain at 0 out of 100, and it appears on a single security blocklist.

VirusTotal records 19 of 91 scanning engines flagging the host as malicious, and the domain is listed by PhishDestroy as taken offline. The current operational status is reported as offline, and the nameserver query returned no records (NS_NOT_FOUND). The combination of a low trust score, multiple vendor detections, a credential‑phishing classification, and the presence on a dedicated phishing blocklist suggests that the domain was actively used for credential harvesting before being taken down.

Uncertainties remain regarding the exact phishing kit employed and whether any residual infrastructure remains reachable. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurgence of the same IP address or similar sub‑domains, and update detection signatures to include the observed page title and TLS fingerprint. Ongoing threat‑intel feeds should be consulted for any new indicators that may arise from related Framer‑hosted domains.