physical-state-924166[.]framer[.]app

On July 25 2026, security analysts observed that the domain physical-state-924166.framer.app is currently offline but retains several indicators of malicious use. The domain was registered on 02 Oct 2020 through CSC Corporate Domains, Inc. and resolves to the Amazon Web Services address 35.71.142.77, which belongs to ASN 16509 (Amazon.com, Inc.) and is geolocated in the United States. The hosting environment serves a Let’s Encrypt E7 certificate and enforces HSTS over HTTP/3, confirming the presence of modern web‑stack components. DNS resolution is handled by four AWS name servers (ns‑1371.awsdns‑43.org, ns‑625.awsdns‑14.net, ns‑51.awsdns‑06.com, ns‑2002.awsdns‑58).

A request to the root URL returns an HTTP 404 response, and the only visible page title is “My Framer Site”, indicating that the site was built with the Framer Sites platform and likely employs a React front‑end. VirusTotal scans show that 14 of 95 antivirus engines flagged the domain as malicious, and the domain appears on a single public blocklist. PhishDestroy has explicitly blocked the host, reinforcing the classification as a phishing infrastructure. No additional intelligence such as Safe Browsing, OTX, or public malware kits is currently linked to the domain, and the content of the site beyond the generic title has not been recovered, leaving the exact phishing lure unspecified.

Given the combination of a recent blocklist entry, multiple vendor detections, and the presence of a legitimate‑looking SSL certificate, defenders should treat the domain as an elevated‑risk phishing resource. Recommended actions include adding the IP address and full host name to outbound and inbound deny lists, monitoring AWS AS16509 traffic for similar patterns, and configuring TLS inspection to capture any encrypted payloads should the site become active again. Continuous re‑scanning through VirusTotal and periodic checks of PhishDestroy feeds are advised to capture potential re‑hosting attempts.