sympathetic-forms-118600[.]framer[.]app

sympathetic-forms-118600.framer.app is currently listed on two public phishing blocklists and remains active as of the report date. The domain is hosted under the Framer B.V. registrar and its authoritative name server information could not be retrieved (NS_NOT_FOUND). DNS resolution points to the IPv4 address 31.43.161.6, which is the sole endpoint observed for this indicator. VirusTotal analysis shows that 14 of 91 scanned security vendors have flagged the domain, indicating a moderate level of detection across multiple engines.

The domain is also present on the PhishDestroy and OpenPhish blocklists, reinforcing its classification as a phishing‑related resource. No additional metadata such as SSL certificate details, HTTP response codes, or page title information is available from the supplied intelligence, leaving the exact content and targeted brand of the site unverified. The lack of visible name server records and the reliance on a single IP address suggest a lightweight hosting configuration typical of short‑lived phishing campaigns. Defenders should block network traffic to 31.43.161.6 and add the full domain to local DNS deny lists.

Monitoring for any new resolution changes or additional detections on VirusTotal and other sandbox services is advised. Because the registrar is a legitimate service (Framer B.V.), abuse reporting should be directed to the registrar’s abuse contact to request takedown of the malicious domain. Continuous observation of the two blocklists that already list the domain will help confirm whether the infrastructure is dismantled or re‑hosted elsewhere.