spiky-days-709346[.]framer[.]app

This domain, spiky-days-709346.framer.app, is identified as a high-risk credential phishing site targeting users of the Framer platform. Analysis confirms the domain was actively impersonating Framer services to harvest login credentials or sensitive user data. As of the latest verification, the domain has been taken offline, though residual risks may persist in cached or archived instances. Infrastructure analysis reveals the domain was registered through Framer's hosting infrastructure and resolved to the IP address 31.43.160.6, geolocated in the Netherlands under AS16509 (Amazon.com, Inc.). The SSL certificate was issued by Let's Encrypt (serial number YE1), a common choice for both legitimate and malicious sites. The domain appeared on one security blocklist and was flagged by Google Safe Browsing for phishing activity. VirusTotal detection metrics indicate 18 of 95 security vendors classified the domain as malicious, with the page title 'My Framer Site' serving as a potential indicator of brand impersonation. Current status confirms the domain is offline, reducing immediate exposure risks. However, organizations and users are advised to proactively block the domain and its associated IP (31.43.160.6) in network security controls. Security teams should review logs for connections to this domain or IP, particularly from endpoints that may have interacted with it prior to takedown. Users who accessed the site should reset credentials for Framer or any other services where identical passwords were used. Monitoring for similar domains registered through Framer's infrastructure is recommended to detect potential follow-up campaigns.