compassionate-plans-884289[.]framer[.]app

compassionate-plans-884289.framer.app has been identified as an active credential theft domain designed to mimic a legitimate service and harvest user login credentials. This Framer-hosted page employs deceptive tactics, including fake login forms, to trick visitors into submitting sensitive information such as usernames, passwords, or financial data. The site leverages social engineering by appearing as a reputable platform, aiming to capture credentials and enable further account compromise or identity theft. Users visiting this domain risk immediate exposure of their login details, which may be reused across multiple accounts or exploited in follow-on attacks. PhishDestroy’s analysis confirms this threat through multiple technical indicators. The domain resolves to IP address 31.44.161.6 and is secured with a Let’s Encrypt SSL certificate, which falsely enhances its legitimacy. According to VirusTotal, the domain is flagged by 11 out of 95 security vendors, indicating widespread detection but not universal blocking. The site is hosted on the Framer platform, a legitimate website builder, which has been abused to deploy phishing content quickly and at scale. While specific creation or registration details are not provided, the presence of an active SSL certificate and low VT coverage suggests this campaign is relatively new or has evaded detection through obfuscation. If you have visited compassionate-plans-884289.framer.app and entered any login credentials, immediately change the password on the real service and enable multi-factor authentication where available. Scan your device with updated antivirus software for potential malware. Avoid reusing passwords across different accounts, especially if the same email or username was used during login. Report the domain to your organization’s security team or the platform being impersonated. Consider using a password manager to detect and prevent reuse of compromised credentials. Stay vigilant for unexpected account activity, phishing emails, or unauthorized transactions.