tiny-functions-660028[.]framer[.]app

This domain, tiny-functions-660028.framer.app, is assessed as an elevated-risk credential harvesting phishing site designed to deceive users into submitting login credentials, financial details, or other sensitive information. Analysis indicates the infrastructure was specifically crafted to mimic legitimate services, exploiting trust in the Framer platform to facilitate fraudulent activity. The threat type aligns with generic phishing but exhibits targeted characteristics, including the use of a subdomain under a reputable service to bypass initial user skepticism. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain resolves to IP address 31.43.160.6, hosted on Amazon.com, Inc. infrastructure (AS16509) in the Netherlands, a common pattern for bulletproof hosting used in phishing campaigns. It is registered through CSC Corporate Domains, Inc., with an anomalous creation date of February 21, 2026, suggesting domain spoofing or backdating to evade detection. The SSL certificate is issued by Let's Encrypt (serial number E7), a frequent choice for threat actors due to its free and automated issuance process. The domain appears on one security blocklist and is flagged by 17 out of 95 security vendors on VirusTotal, including detection as malicious by PhishDestroy. The page title, Site Not Found | Framer, may indicate a takedown or cloaking mechanism to avoid automated scanners while maintaining operational readiness for targeted attacks. Mitigation requires immediate action from both end users and security teams. Users who interacted with this domain should assume credential compromise and initiate password resets for all accounts accessed during the exposure window, prioritizing financial and email services. Security teams should block the domain and associated IP (31.43.160.6) at the perimeter, including DNS and web proxy layers, and monitor for lateral movement or unauthorized access attempts. Given the anomalous creation date, investigate potential domain generation algorithm (DGA) patterns or typosquatting variants. Organizations should also review logs for connections to the IP or domain, particularly from endpoints exhibiting unusual authentication patterns. Forensic analysis of the SSL certificate (Let's Encrypt E7) may reveal additional linked infrastructure, as threat actors often reuse certificates across multiple campaigns. Proactive measures include deploying phishing-resistant authentication methods, such as hardware tokens or certificate-based authentication, to reduce the impact of credential theft.