sympathetic-emails-006032[.]framer[.]app

The domain sympathetic-emails-006032.framer.app was registered on February 21 2026 through CSC Corporate Domains, Inc. It resolves to the Amazon‑owned IP address 35.71.142.77 (AS16509, United States). The host presents an SSL certificate issued by Let’s Encrypt (E7) and serves content over HTTP/3 with HSTS enabled. Automated fingerprinting identified Framer Sites and React as the underlying web technologies. An HTTP request to the root URL returned a 404 status code and the page title “My Framer Site”, indicating that the site no longer hosts visible content.

The domain is currently listed as offline and has been taken down. VirusTotal analysis shows that 16 of 93 scanned security vendors flagged the domain, suggesting malicious intent. The domain appears on a single public blocklist and is actively blocked by the PhishDestroy service. Nameserver delegation points to four AWS DNS endpoints (ns-1371.awsdns-43.org, ns-2002.awsdns-58.co.uk, ns-51.awsdns-06.com, ns-625.awsdns-).

No additional intelligence such as phishing page screenshots, credential‑harvesting forms, or targeted brand information is available from the provided data. The primary indicators – recent registration, association with a cloud provider, presence of a valid TLS certificate, and multiple vendor detections – are consistent with a generic phishing infrastructure. Defenders should add the domain and its resolved IP to blocklists, monitor DNS queries for the listed nameservers, and consider extending detection rules to cover similar Framer‑based payloads. Continuous re‑assessment is recommended, as the offline status may change if the operators reactivate the site.