tactical-audience-155694[.]framer[.]app

The domain tactical-audience-155694.framer.app has been identified as a potential credential theft scam. While no specific brand impersonation or drainer kit is noted, the page title 'Identifiez-vous' suggests that the domain may have been used to trick users into disclosing sensitive login credentials.

Analysis indicates that 20 out of 95 security vendors on VirusTotal flag this domain as malicious. The domain is registered through Framer and resolves to the IP address 31.43.160.6, which is located in the Netherlands and belongs to Framer B.V. The domain was created on May 04, 2026. The Global Security Database (GSB) lists this domain as taken offline, and it appears on 1 security blocklist. The SSL certificate is issued by Let's Encrypt, indicating a basic level of HTTPS encryption.

The current status of the domain is offline, which reduces the immediate risk of active exploitation. However, it is advised that users remain cautious and avoid any links or content associated with this domain. Security teams should monitor for any resurgence of the domain and ensure that network defenses are configured to block it. The elevated risk level suggests that the domain may still be part of a broader campaign, and further investigation is recommended to identify any related infrastructure or activities.