glorious-shape-173131[.]framer[.]app

glorious-shape-173131.framer.app is presently listed as an active generic phishing infrastructure. The domain resolves to the IPv4 address 31.43.161.6 and is registered through Framer B.V., a known provider of web‑hosting services. VirusTotal reports that 17 of 91 scanners have flagged the host, indicating a moderate level of detection across the security community.

The domain has been added to at least one external blocklist and is specifically blocked by the PhishDestroy sinkhole, confirming that defensive operators have already taken mitigation steps. Nameserver queries return NS_NOT_FOUND, suggesting that the authoritative DNS records are either intentionally hidden or misconfigured, which can hinder rapid takedown but also signals a deliberate attempt to obscure infrastructure. Evidence does not include page‑title information, SSL certificate details, or explicit brand targeting, so the exact lure employed by the site remains unknown.

Nevertheless, the combination of a known hosting provider, a single public IP address, and multiple vendor detections points to a low‑cost, rapidly deployed phishing campaign that relies on the framer.app sub‑domain ecosystem for anonymity. Defenders should add 31.43.161.6 and glorious-shape-173131.framer.app to outbound and inbound filtering rules, ensure that any internal DNS resolvers block the domain, and monitor for related sub‑domains under the framer.app namespace. Continuous re‑evaluation is advised, as the threat actor may repoint the domain to new infrastructure or expand the campaign to additional targets.