frame2uavapro[.]org

This domain, frame2uavapro.org, is identified as a high-risk phishing site targeting users with fraudulent automated investment services. The page title, 'Frame 2U Avapro | Investimenti automatizzati con IA per investitori moderni,' suggests an attempt to impersonate legitimate AI-based financial platforms, likely to harvest credentials or financial details. No specific drainer kit signatures were confirmed, but the domain exhibits characteristics consistent with generic phishing infrastructure, including social engineering tactics to deceive victims into disclosing sensitive information.

Analysis indicates the domain was registered through NameCheap, Inc. on March 05, 2026, and resolves to the IP address 104.21.44.129. VirusTotal detection rates show 11 out of 95 security vendors flagging the domain as malicious. Google Safe Browsing categorizes the threat as 'SOCIAL_ENGINEERING,' and the domain appears on three security blocklists. The infrastructure aligns with known phishing patterns, including the use of cloud-based hosting to evade initial detection.

As of the latest assessment, frame2uavapro.org has been taken offline, likely due to enforcement actions by security providers. The domain was blocked by multiple threat intelligence feeds, including MetaMask, PhishDestroy, and SEAL. Despite its current offline status, residual risk remains for users who may have interacted with the site prior to takedown. Organizations are advised to update blocklists, monitor for related IOCs, and conduct retrospective analysis on network logs for connections to 104.21.44.129 or the domain itself.