compassionate-hiring-458007[.]framer[.]app

The domain compassionate-hiring-458007.framer.app is currently active and resolves to the IPv4 address 31.43.160.6. Registration information shows the domain was created through the Framer B.V. website‑builder service, a pattern frequently abused for credential‑harvesting campaigns. The domain appears on a single public security blocklist and is explicitly blocked by the PhishDestroy feed, indicating that at least one anti‑phishing organization has observed malicious use. VirusTotal analysis records 13 of 91 scanning engines flagging the host, reinforcing the suspicion of malicious activity.

DNS queries return no name‑server (NS) records, which may reflect a misconfiguration or an attempt to evade typical reconnaissance. No SSL/TLS certificate details, Safe Browsing verdicts, or page‑title metadata are available in the supplied intelligence, so the exact content served by the site remains unknown. Likewise, the lack of visible branding or a defined phishing kit prevents precise attribution of the campaign’s target.

Given the combination of active resolution, blocklist inclusion, multi‑engine detection, and the use of a reputable web‑hosting platform for likely abuse, defenders should treat the domain as high‑risk. Recommended actions include adding the domain to network‑level deny lists, configuring DNS sinks or proxy blocks, and monitoring outbound traffic for connections to 31.43.160.6. Continuous re‑evaluation is advised as additional telemetry (e.g., page snapshots, certificate data, or user reports) becomes available.