various-copy-183010[.]framer[.]app

This domain is flagged as an elevated-risk fake login portal designed to harvest user credentials. Analysis indicates the site mimics legitimate authentication pages, tricking victims into entering sensitive account details, which are then exfiltrated to attacker-controlled infrastructure. The threat type aligns with credential phishing, a common vector for account takeovers and subsequent fraud. Infrastructure analysis reveals the domain various-copy-183010.framer.app is registered through Framer and resolves to the IP address 31.43.161.6. The site holds a Let's Encrypt SSL certificate, providing a false sense of security. VirusTotal detection metrics show 18 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is currently blocked by enterprise-grade security filters. The page title, 'Home,' suggests an attempt to appear as a generic landing page, while the unique seed identifier 37fb13 may correlate with other phishing campaigns. The domain has since been taken offline, though historical data remains critical for threat correlation. Mitigation steps for this specific threat type include immediate revocation of any credentials entered on the site, particularly if reused across other platforms. Organizations should update security policies to block domains registered through Framer with similar naming patterns (e.g., 'various-copy-XXXXX') and monitor for connections to the IP 31.43.161.6. End-users should enable multi-factor authentication on all accounts and verify domain authenticity before entering login details. Security teams are advised to review logs for prior interactions with this domain and correlate with other known phishing indicators, such as the Let's Encrypt certificate issuer and the VirusTotal detection ratio of 18/95.