relieved-nonogon-227566[.]framer[.]app

relieved-nonogon-227566.framer.app was created on 02 October 2020 and is currently listed as offline. DNS resolution points to 52.223.52.2, an address owned by Amazon.com, Inc. (AS16509) located in the United States. HTTP requests return a 404 status code, and the site presents a Let's Encrypt certificate issued under the E7 profile, indicating TLS is active but the content is unavailable. Automated analysis detected the presence of Framer Sites, React, HTTP Strict Transport Security (HSTS) and HTTP/3, which are typical of modern web‑hosting stacks.

The domain was registered through CSC Corporate Domains, Inc., and uses four Amazon Route 53 name servers: ns-1371.awsdns-43.org, ns-2002.awsdns-58.co.uk, ns-51.awsdns-06.com and ns-625.awsdns-. The page title returned by the server is “My Framer Site”, which provides no further indication of malicious intent. Security telemetry shows the domain appears on a single blocklist and has been actively blocked by PhishDestroy. VirusTotal scans report that 17 of 93 scanning engines flag the domain as malicious, reinforcing the suspicion of phishing activity.

The elevated risk rating aligns with the combination of a relatively recent creation date, use of reputable cloud infrastructure, and the presence of multiple security vendor detections. Uncertainty remains around the specific phishing lure or victim profile, as no landing‑page content has been captured and the title offers no clues. Analysts should continue to monitor the IP address for any re‑hosting of content, enforce blocking of the domain and its associated IP at perimeter defenses, and ensure that endpoint protection solutions are updated with the latest indicator set. Additional collection of the site’s HTML, network traffic, and any associated URLs would be required to fully characterize the threat vector.