trusty[.]framer[.]ai

Analysis of the domain trusty.framer.ai indicates an active generic phishing infrastructure. The domain is listed on three public security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, confirming its presence in multiple threat‑intelligence feeds. Registration data shows the domain was created through Framer B.V., but the authoritative nameserver records are unavailable (NS_NOT_FOUND), limiting visibility into DNS control changes. Network resolution points to a single IPv4 address, 31.43.161.6, which is the sole host associated with the domain in current DNS queries.

The IP address has not been publicly linked to other malicious campaigns, but its isolation suggests a dedicated staging point for phishing traffic. VirusTotal reports indicate the domain was scanned by 91 vendor engines without any detections at the time of analysis; however, the absence of alerts does not constitute a safety assurance, as automated signatures frequently lag behind novel phishing kits. No SSL certificate details, HTTP response codes, page titles, or content snapshots are available, leaving the web‑layer characteristics unverified.

Given the confirmed blocklist presence, the known IP resolution, and the lack of defensive evidence, security teams should treat trusty.framer.ai as high‑risk. Recommended actions include adding the domain and its resolved IP to outbound deny lists, monitoring DNS queries for recurring resolutions, and employing URL‑filtering solutions that reference the blocklists reporting the domain. Continuous re‑evaluation is advised, as future changes in hosting or content could alter the threat profile.