flowing-begin-304744[.]framer[.]app

Analysis of the domain flowing-begin-304744.framer.app, registered through CSC Corporate Domains, Inc. on October 2, 2020, shows it was leveraged for a banking phishing campaign. The site was hosted on Amazon’s AS16509 infrastructure in the United States and resolved to IP 52.223.52.2, which is served by the Let’s Encrypt E7 certificate and enforces HSTS over HTTP/3. Technical fingerprints indicate the use of Framer Sites and a React front‑end, consistent with low‑cost phishing kits that exploit modern web frameworks. The page title returned by the server was "Go on" and the HTTP response code was 404, suggesting the content was removed or the site is currently offline.

Security telemetry shows the domain is listed on one blocklist and was blocked by PhishDestroy. VirusTotal scans flagged the domain in 16 of 93 vendor engines, reinforcing its malicious classification. Nameservers ns-1371.awsdns-43.org, ns-2002.awsdns-58.co.uk, ns-51.awsdns-06.com, and ns-625.awsdns- are consistent with AWS DNS services.

While the site is presently taken offline, the infrastructure—particularly the Amazon‑hosted IP and the Framer/React stack—remains reusable for future phishing deployments. Defenders should continue to block the domain and its associated IP, monitor for re‑registration or similar sub‑domains, and incorporate the observed indicator set (page title, certificate details, and vendor detection count) into detection rules. Ongoing surveillance of the registrar CSC Corporate Domains, Inc. and the AS16509 host may reveal additional malicious assets linked to this campaign.