new-conference-643300[.]framer[.]app

This domain, new-conference-643300.framer.app, has been identified as part of a credential theft phishing campaign targeting users of online collaboration and conferencing platforms. The site masqueraded as a legitimate service portal, likely leveraging social engineering tactics to harvest login credentials from unsuspecting victims. No specific drainer kit or cryptocurrency-related payloads were confirmed in this instance, though the infrastructure aligns with broader phishing operations observed in recent months. The page title, 'Site Not Found | Framer,' suggests the domain may have been part of a larger, ephemeral campaign designed to evade detection by rotating subdomains or hosting environments.

Technical indicators confirm the domain's malicious classification. The domain resolves to the IP address 31.43.160.6, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509) in the Netherlands. It was registered through CSC Corporate Domains, Inc. on February 21, 2026, though the creation date may reflect an administrative placeholder rather than active deployment. At the time of analysis, the domain appeared on one security blocklist and was flagged by 18 out of 95 security vendors on VirusTotal. The SSL certificate, issued by Let's Encrypt (serial number E7), provided minimal assurance, as phishing domains frequently leverage free certificates to appear legitimate. No detections were reported in Google Safe Browsing at the time of this assessment, though this may reflect a lag in propagation rather than benign status.

The domain has since been taken offline, reducing immediate exposure risk. However, the infrastructure and registrar history suggest the operators may redeploy similar domains under different subdomains or parent domains. Users who interacted with the site are advised to rotate credentials for any accounts accessed during the exposure window, particularly those tied to professional or financial services. Organizations should monitor for additional subdomains under the framer.app parent domain and update blocklists to include the IP address 31.43.160.6. The elevated risk level persists due to the domain's prior use in credential theft, and defenders should treat any future iterations of this infrastructure as presumptively malicious.