primary-future-640426[.]framer[.]app

Analysis of primary-future-640426.framer.app indicates that the domain is actively used for phishing operations. The site was registered through the Framer platform, a service that provides web‑hosting and design tools, which is consistent with the observed infrastructure. Independent threat‑intel feeds have marked the domain as malicious: PhishDestroy has placed it on its blocklist, and it appears on an additional security blocklist, confirming that at least two reputable sources have taken defensive action against it.

VirusTotal scans show that 12 of 91 security vendors have flagged the domain as malicious, providing a modest but notable detection consensus across a broad vendor base. No further details on SSL configuration, HTTP response codes, IP location, or page metadata have been released, leaving those aspects of the infrastructure unverified at this time. Defenders should treat the domain as hostile and incorporate it into network‑level deny lists, DNS filtering, and endpoint protection rules.

Continuous monitoring of the domain’s resolution and any associated IP addresses is advised, as changes in hosting or certificate deployment could alter its threat profile. Organizations should also review outbound traffic logs for connections to the framer.app sub‑domain space to identify potential compromised hosts or data exfiltration attempts. Given the current evidence, the risk rating remains elevated, and proactive blocking is the recommended mitigation step.