final-kimchi-072485[.]framer[.]app

This domain, final-kimchi-072485.framer.app, is identified as a high-risk generic phishing site designed to harvest user credentials or distribute malicious payloads. Analysis indicates no direct brand impersonation, but the infrastructure aligns with broad-scale phishing campaigns targeting unsuspecting users. No specific drainer kit signatures were detected in initial scans, though the domain exhibits characteristics typical of credential theft operations. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 52.223.52.2 (US, AS16509 Amazon.com, Inc.) and was registered through CSC Corporate Domains, Inc. on February 21, 2026. It is flagged by 20 out of 95 security vendors on VirusTotal and appears on 3 distinct security blocklists. The SSL certificate is issued by Let's Encrypt (serial number E7), and the domain is currently blocked by PhishDestroy, MetaMask, and SEAL. No Google Safe Browsing (GSB) hits were recorded at the time of analysis. The domain has been taken offline, reducing immediate risk to end users. However, residual threats persist, including potential reuse of the infrastructure for future campaigns or lateral movement within compromised environments. Organizations are advised to monitor for connections to the associated IP (52.223.52.2) and domain in historical logs, as well as to update blocklists to include this indicator. Users who may have interacted with the domain should reset credentials and scan systems for secondary infections.