ext-phntom-io[.]framer[.]media

Analysis of the domain ext-phntom-io.framer.media has confirmed it to be a high-risk fake login site designed to steal user credentials and sensitive information. The domain was taken offline on or before the date of this report, indicating a potential ongoing campaign targeting users who may not be aware of the domain's malicious nature.

Infrastructure analysis reveals that the domain was registered through CSC Corporate Domains, Inc. on February 21, 2026. It resolved to the IP address 52.223.52.2, which is located in the United States and is part of the AS16509 Amazon.com, Inc. network. The domain has appeared on three security blocklists and is blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal, a widely used threat intelligence platform, reports that 12 out of 95 security vendors have flagged this domain as malicious. The SSL certificate was issued by Let's Encrypt, which is a common practice for phishing sites to appear more legitimate to unsuspecting users.

Users who have visited the domain ext-phntom-io.framer.media are advised to immediately change their passwords for any accounts they may have entered credentials into and monitor their accounts for any unauthorized activity. It is also recommended to run a comprehensive security scan on their devices to ensure no malware was installed. Additionally, users should be cautious of any future communications that seem suspicious and report any such incidents to their respective security teams or organizations.