home-ledegrlive[.]framer[.]media

Analysis of the domain home-ledegrlive.framer.media indicates it was flagged as part of a generic phishing infrastructure targeting users of the Framer platform. The domain, registered on November 19, 2021, through CSC Corporate Domains, Inc., resolved to the IP address 35.71.142.77, hosted on Amazon Web Services (AS16509) in the United States. At the time of investigation, the domain returned an HTTP 404 status with the page title 'Site Not Found | Framer,' suggesting either a decommissioned phishing page or a placeholder left in the infrastructure. The SSL certificate, issued by Let's Encrypt (serial E7), remains valid, which is consistent with phishing domains leveraging free certificates to appear legitimate.

The domain was detected by 14 of 93 security vendors on VirusTotal, a signal of malicious classification, though the exact nature of the phishing content is not confirmed due to the 404 response. It appears on at least one security blocklist and was proactively blocked by PhishDestroy. Technologies detected on the domain include Framer Sites, React, HSTS, and HTTP/3, aligning with legitimate Framer deployments but also enabling threat actors to blend in with authentic traffic. Nameservers are hosted under AWS (ns-1267.awsdns-30.org, ns-1854.awsdns-39.co.uk, ns-535.awsdns-02.net, ns-97.awsdns-01.com), a common pattern for phishing domains leveraging cloud infrastructure for scalability and resilience.

Defenders should treat this domain as part of a broader phishing campaign, particularly given its association with Framer’s branding in the page title. While the domain is currently offline, historical DNS and SSL records may still pose risks if cached or reused. Organizations should monitor for any reactivation, review logs for prior connections to 35.71.142.77, and consider blocking the domain and associated IP at the network level.