nuanced-village-151417[.]framer[.]app

This domain is flagged as a high-risk phishing endpoint targeting users through fraudulent electronic registered letter (AR24) lures. The specific threat type involves credential harvesting and social engineering, presenting a cloned interface of a legitimate electronic registered mail service to deceive victims into submitting sensitive authentication details or personal information. Analysis indicates the domain nuanced-village-151417.framer.app was detected by 21 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly categorizing it as phishing. It appears on one security blocklist and was registered through Framer, a platform often exploited for rapid deployment of malicious landing pages. The domain resolves to IP address 31.43.160.6, hosted on Amazon.com, Inc. infrastructure (AS16509) in the Netherlands. The SSL certificate is issued by Let's Encrypt (serial YE1), a common choice for threat actors due to its low barrier to entry. The page title, 'Lettre recommandée électronique en Ligne - AR24,' directly mimics the branding of a legitimate French electronic registered mail provider, increasing the likelihood of successful deception. Mitigation requires immediate blocking of the domain and its resolving IP (31.43.160.6) at the network perimeter. Security teams should prioritize scanning for indicators of compromise, including HTTP referrers or user-agent strings associated with visits to nuanced-village-151417.framer.app. End-user education should emphasize verification of electronic registered mail sources, particularly those requesting login credentials or payment details. Monitoring for similar domains registered through Framer or resolving to the same IP range (31.43.160.0/24) is recommended to preemptively identify related threats. If the domain was accessed internally, initiate password resets for potentially exposed accounts and review logs for anomalous authentication attempts.