webmail-spectrumlogin-login-zimbram[.]framer[.]website

The domain webmail-spectrumlogin-login-zimbram.framer.website was observed on August 07, 2026 as part of an active credential phishing campaign. Infrastructure analysis reveals that the domain resolves to the IPv4 address 31.43.160.6, which is currently the sole host observed for this indicator. Reputation checks show that the domain has been listed on two external security blocklists and is explicitly blocked by the PhishDestroy and OpenPhish feeds, confirming its classification as a malicious phishing resource.

VirusTotal has recorded 15 of 91 security vendors flagging the domain, providing additional corroboration of its malicious intent. No further technical details such as SSL certificate data, HTTP response codes, or page title content are available in the supplied intelligence, leaving the exact page behavior unverified. The elevated risk rating reflects the combination of multiple vendor detections, blocklist presence, and confirmed active status.

Defensive recommendations include immediate network‑level blocking of the domain name and its resolving IP address, updating DNS filtering policies to deny resolution, and monitoring outbound traffic for any connections to 31.43.160.6. Security operations should also add the domain to internal phishing indicator lists and enable real‑time alerts for any future appearance in logs. Continuous re‑evaluation is advised, as additional telemetry may surface further artifacts such as payload signatures or compromised credentials associated with this infrastructure.