favorite-department-376487[.]framer[.]app

PhishDestroy identifies favorite-department-376487.framer.app as an active crypto drainer phishing domain masquerading as a generic landing page on framer.app. This site is engineered to trick visitors into connecting wallets or approving malicious token transfers, redirecting cryptocurrency to attacker-controlled addresses. The domain is currently resolving to 31.43.160.6, a server with a Let's Encrypt SSL certificate, which gives it a veneer of legitimacy that is easily stripped away by security analysis.

This domain was flagged by 10 out of 95 VirusTotal security vendors, indicating elevated threat detection across antivirus, threat intelligence, and web reputation platforms. The site is hosted on framer.app’s platform, a legitimate site-builder service, which is being abused via subdomain spoofing to host malicious content. These characteristics suggest the attacker registered the subdomain to impersonate a harmless or corporate site while pushing a crypto drainer payload.

If you visited favorite-department-376487.framer.app, immediately disconnect your wallet or revoke any permissions granted. Do not approve transactions, sign messages, or connect additional wallets. Run a malware scan on your device and rotate all exposed wallet credentials. Use PhishDestroy to verify the domain’s status before interacting with any crypto-related links or forms. Stay alert—crypto drainers often impersonate legitimate platforms and exploit urgency to steal funds.