artsy-popover-318610[.]framer[.]app

PhishDestroy identifies artsy-popover-318610.framer.app as an active crypto drainer phishing domain designed to steal cryptocurrency assets. This domain masquerades as a legitimate application hosted on Framer.app, a platform typically used for portfolio and landing page creation. Upon analysis, the domain resolves to IP address 31.43.161.6, which hosts a Let’s Encrypt SSL certificate to lend an air of legitimacy. The domain is currently flagged by 8 out of 95 security vendors on VirusTotal, indicating a moderate but elevated detection rate. This domain was flagged with unique seed identifier 122ad9 and poses an elevated risk due to its active status and targeted use of a crypto drainer mechanism. While the registrar and creation date are not explicitly provided in available intelligence, the domain’s association with Framer.app suggests a recent deployment aimed at deceiving users familiar with the platform. The blocklist count of 8/95 detections on VirusTotal underscores its malicious nature, particularly given the low ratio of clean detections. The SSL certificate, issued by Let’s Encrypt, is commonly leveraged by threat actors to avoid browser warnings, further enhancing the domain’s credibility in the eyes of potential victims. Users who have visited artsy-popover-318610.framer.app should immediately disconnect from the site and perform a full scan of their device using updated antivirus software. If any cryptocurrency transactions or wallet connections were made during the visit, revoke permissions for connected wallets immediately and transfer remaining assets to a cold storage wallet. Report the domain to PhishDestroy and monitor financial accounts for unauthorized activity. Avoid interacting with the domain or any associated links, as continued exposure may result in further compromise.