humorous-zebra-189284[.]framer[.]app

Analysis of humorous-zebra-189284.framer.app shows that the domain is currently offline, returning an HTTP 404 status code. The site was registered through Framer and is served over HTTPS using a Let’s Encrypt certificate (identifier YE1). DNS queries return no nameserver records, indicating that the authoritative NS entries are either missing or deliberately concealed. The domain resolves to IP address 31.43.161.6, which is hosted in the Netherlands and belongs to Amazon.com, Inc. (ASN16509).

VirusTotal reports that 12 of 91 scanning engines flagged the domain, and it appears on a single external blocklist. PhishDestroy has also listed the domain as blocked, confirming that it has been identified as a phishing vector. The page title retrieved from the host is "My Framer Site," but no further content analysis is available, so the specific payload or credential‑harvesting mechanisms remain unknown. Given the limited public evidence, defenders should treat the domain as a confirmed phishing infrastructure element and enforce preventive controls.

Recommended actions include adding the domain and its resolving IP to network blocklists, monitoring for any re‑activation or DNS changes, and ensuring that endpoint security solutions incorporate the VirusTotal detection data. Continuous observation of the hosting provider (Amazon AWS) for related activity may help identify additional malicious domains that share the same infrastructure. Until the site is taken down permanently, organizations should maintain vigilance and apply standard phishing mitigation techniques such as email filtering, user education, and URL reputation checks.