consistent-play-637903[.]framer[.]app

This domain, consistent-play-637903.framer.app, is identified as a high-risk generic phishing site specifically targeting cryptocurrency wallet credentials. Analysis indicates the infrastructure was designed to mimic legitimate wallet interfaces, likely deploying a drainer kit to siphon digital assets upon user interaction. The domain exhibits no direct brand impersonation but employs social engineering tactics typical of crypto-focused phishing campaigns. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 52.223.52.2, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. It was registered through CSC Corporate Domains, Inc. on February 21, 2026, with a Let's Encrypt SSL certificate (serial E7). Detection metrics show 22 out of 95 security vendors flagged the domain on VirusTotal, while it appears on three distinct security blocklists. No Google Safe Browsing (GSB) status is recorded for this domain. The domain is currently offline, likely following takedown actions or automated suspension by the hosting provider. Despite its inactive status, residual risk persists due to potential cached DNS records or archived phishing pages. Users who interacted with the domain prior to its deactivation are advised to revoke any connected wallet permissions, monitor for unauthorized transactions, and rotate credentials associated with cryptocurrency accounts. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.