plum-seat-282538[.]framer[.]app

The domain plum-seat-282538.framer.app was registered on March 03, 2026 through the Framer platform. The site resolves to the IPv4 address 31.43.160.6, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the Netherlands. An SSL certificate issued by Let’s Encrypt (subject identifier E7) is present, and the server reports HTTP/3 support and enforces HSTS. The HTTP response code is 404, indicating that the requested resource is not found. Automated analysis identified the use of Framer Sites and the React JavaScript framework.

The page title returned by the server is “Sign in to Xfinity,” while the threat intelligence tag classifies the campaign as a brand impersonation targeting BT. The mismatch between the page title and the claimed target suggests the site may be attempting to harvest credentials for multiple brands, but the current evidence only confirms the BT impersonation label. The domain appears on a single security blocklist and has been blocked by PhishDestroy. VirusTotal scans show that ten of ninety‑five scanning engines flagged the domain as malicious. The infrastructure indicates a low‑cost hosting arrangement typical of short‑lived phishing campaigns, and the presence of a valid TLS certificate does not mitigate the risk.

As of the report date, the domain is offline, but the underlying hosting resources remain active and could be reused. Defenders should continue to monitor the IP address 31.43.160.6 for any resurgence of malicious activity, enforce blocklist updates that include plum-seat-282538.framer.app, and consider adding the domain to URL filtering policies. Organizations using the BT brand should educate users about unexpected login prompts that reference unrelated services such as Xfinity, and should verify that legitimate BT communications never direct users to third‑party Framer subdomains.