heartwarming-notes-259621[.]framer[.]app

Analysis of the domain heartwarming-notes-259621.framer.app, observed on July 21, 2026, indicates active generic phishing infrastructure. The domain is registered through Framer B.V., a legitimate registrar, but its DNS configuration is incomplete; the nameserver query returns NS_NOT_FOUND, suggesting either rapid deployment or evasion of typical DNS resolution patterns. Resolution points to the IPv4 address 31.43.161.6, which is the sole hosting endpoint identified for this campaign. Reputation services have placed the domain on one security blocklist, and PhishDestroy currently blocks it, confirming that threat‑intelligence feeds recognize it as malicious. VirusTotal scans show that three out of ninety‑five participating security vendors flag the domain, providing independent corroboration of its malicious nature despite the relatively low detection ratio. The public web‑site content has not been captured in the available intelligence; consequently, page title, SSL certificate details, HTTP response codes, and Safe Browsing status remain unknown. Absence of such data limits behavioral analysis but does not diminish the observed risk indicators. Defenders should proactively block DNS resolution to 31.43.161.6 and add heartwarming-notes-259621.framer.app to local and network‑level blocklists. Continuous monitoring of the IP address for additional domain registrations or changes in DNS records is recommended. Given the active status, any inbound traffic to the domain should be inspected or denied, and email gateways should be updated to flag URLs containing the framer.app sub‑domain pattern. Overall, the combination of registrar information, blocklist inclusion, vendor detections, and single‑IP hosting provides a concrete evidence set that this domain participates in a high‑risk phishing campaign. Further investigation should focus on capturing the landing page content and correlating the IP with other known malicious actors to refine attribution.