zsdrtgsrtghgdfghghdfgdfghdhg[.]framer[.]wiki

This domain, zsdrtgsrtghgdfghghdfg.framer.wiki, is actively serving a credential phishing page as of July 12, 2026. Analysis indicates the site is hosted on infrastructure associated with AS16509 (Amazon.com, Inc.) in the Netherlands, resolving to IP 31.43.161.6. The domain is registered through CSC Corporate Domains, Inc., and uses AWS nameservers (ns-1185.awsdns-20.org, ns-423.awsdns-52.com, among others). A valid SSL certificate from Let's Encrypt is present, and the HTTP response status is 200, suggesting the page is operational. The page title, 'Sign in to your account,' aligns with credential harvesting tactics, though the specific brand or service being impersonated is not confirmed in available data. The domain is flagged by 18 of 91 security vendors on VirusTotal and appears on one security blocklist. Technologies detected include Framer Sites, React, HSTS, and HTTP/3, which may be leveraged to enhance the site's legitimacy or evade detection. Defenders should treat this domain as high-risk. Immediate actions include blocking the domain and its resolving IP at network and endpoint levels, monitoring for credential submission attempts, and reviewing logs for connections to 31.43.161.6 or related AWS nameserver traffic. The domain's use of HSTS and HTTP/3 may complicate interception or analysis, so passive monitoring is recommended where active inspection is not feasible. No evidence suggests lateral movement or secondary payload delivery, but credential phishing remains the primary threat vector.