good-difference-990666[.]framer[.]app

This domain is flagged as a high-risk phishing site specializing in credential harvesting through fraudulent electronic registered mail (Lettre Recommandée Électronique) lures targeting AR24 users. The page title, "Lettre Recommandée Électronique AR24," mimics legitimate postal notification services to deceive recipients into submitting sensitive login credentials or personal data. Analysis indicates the domain good-difference-990666.framer.app is registered through Framer and resolves to IP address 31.43.160.6, hosted on Amazon.com, Inc. infrastructure (AS16509) in the Netherlands. VirusTotal reports 22 out of 95 security vendors detecting the domain as malicious. The SSL certificate is issued by Let's Encrypt (identifier YE1), and the domain appears on one security blocklist. Google Safe Browsing has explicitly flagged the site as phishing. Current status shows the domain has been taken offline, though prior activity remains a concern. Mitigation steps for this threat type include blocking the domain and its resolving IP (31.43.160.6) at perimeter security controls. Network administrators should monitor for connections to this IP or related domains registered under Framer. End-users should be educated on recognizing phishing lures mimicking electronic registered mail services, particularly those impersonating AR24. If credentials were submitted, immediate password resets and multi-factor authentication enforcement are recommended. Logs should be reviewed for any prior interactions with the domain or IP to assess potential compromise.