newcomer-courgette-121562[.]framer[.]app

This domain, newcomer-courgette-121562.framer.app, has been identified as a platform designed to execute credential theft. The primary objective of the threat actors is to capture sensitive information such as usernames, passwords, and potentially other personal data from unsuspecting users. The domain's deceptive appearance and functionalities are crafted to mimic legitimate websites, thereby tricking users into divulging their credentials.

Analysis indicates that the domain has been flagged by 18 out of 95 security vendors on VirusTotal, suggesting a significant level of suspicious activity. The domain is registered through Framer, a legitimate website building and design platform, which may have been abused by threat actors to host the malicious content. Infrastructure analysis reveals that the domain resolves to the IP address 31.43.160.6, located in the Netherlands and associated with AS16509, Amazon.com, Inc. The SSL certificate is issued by Let's Encrypt, a trusted certificate authority, which further complicates detection by providing a secure connection that users might interpret as a sign of legitimacy. The domain appears on one security blocklist, indicating it has been recognized by at least one security organization as a potential threat.

If users have visited newcomer-courgette-121562.framer.app and entered any personal information, they should immediately change their passwords for all relevant accounts. It is recommended to enable two-factor authentication (2FA) for additional security. Users should also monitor their accounts for any unauthorized activity and consider running a full system scan to detect and remove any potential malware. Reporting the incident to the affected service providers and to relevant security authorities is advised to help mitigate the impact and prevent further compromise.