gvtc-auth.framer.ai is an impersonation phishing page built on a subdomain of Framer, a website-building platform. The "gvtc-auth" label presents it as a GVTC sign-in portal, targeting people who would expect to log in to a GVTC account. PhishDestroy first saw it on 2026-09-07. It has been offline since 2026-09-16 and was still down with no content at the root on 2026-10-19.
How the scam works
Pages like this copy the look of a real login screen and get sent to victims through email, text or search results. Anything typed into the form, such as a username, password or one-time code, goes to the operator, who can then take over the account or reuse the password elsewhere. Hosting it on a Framer subdomain gives the link a polished, legitimate-looking address with no domain purchase needed. The page now shows "Site Not Found | Framer", while we classified it as impersonation phishing.
Evidence
VirusTotal returned 12 detections out of 89 engines on 2026-09-17. The flagging vendors were alphaMountain.ai, Chong Lua Dao, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data and Gridinsoft. Those detections came a day after the page went dark, so the verdicts reflect the phishing content it had hosted, not the current error page. PhishDestroy lists the hostname on its blocklist.
Infrastructure
The 2018-01-06 registration date and the CSC Corporate Domains registrar belong to Framer's own parent domain, not to the attacker. The operator only had to create a free subdomain, which explains how the page went live without any domain history of its own. Traffic is served from Amazon network space in the Netherlands, which is Framer's normal hosting arrangement. The site lasted about nine days after PhishDestroy first saw it before it was taken offline.
What to do
If you entered credentials on this page, change your GVTC password right away. Change it on any other service where you used the same password, and turn on two-factor authentication wherever it is offered. Check your account for unfamiliar logins, forwarding rules or contact changes. Treat any follow-up messages that mention this login with suspicion. Defenders should block the specific hostname rather than the whole Framer platform, search mail logs for links to it, and report any new lookalike subdomains to Framer for removal.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(US)
