plum-beautifully-875812[.]framer[.]app

The domain plum-beautifully-875812.framer.app has been identified as a generic phishing site engaged in brand impersonation, specifically targeting the Framer platform. Currently, the domain is offline, though prior activity suggests it was designed to deceive users into disclosing credentials or interacting with fraudulent content under the guise of a legitimate service. No specific payload delivery (e.g., crypto drainer) has been confirmed, but the infrastructure aligns with credential harvesting tactics. Analysis indicates the domain was flagged by 20 of 95 security vendors on VirusTotal, reflecting elevated detection rates. It was registered through Framer on March 27, 2026, an unusually future-dated creation that may indicate automated abuse or domain squatting. The domain resolves to the IP address 31.43.160.6, located in the Netherlands and associated with Framer B.V.'s hosting infrastructure. A single security blocklist entry further corroborates its malicious classification. The SSL certificate, issued by Let's Encrypt (serial number E7), provides no inherent trust signal due to its automated issuance process. Infrastructure analysis reveals the domain was taken offline following detection, though residual risk persists for users who may have interacted with it prior to deactivation. Organizations are advised to block the domain and IP at the perimeter, monitor for credential reuse attempts, and review logs for connections to 31.43.160.6. Given the future-dated registration, additional domains with similar naming patterns (e.g., randomly generated subdomains under framer.app) should be treated with heightened scrutiny. End users should verify the legitimacy of any Framer-related communications through official channels.