eternal-team-881838[.]framer[.]app

Analysis of the domain eternal-team-881838.framer.app indicates that it is currently active and classified as a high‑risk generic phishing operation. The domain resolves to the IPv4 address 31.43.160.6, and its registration details show it was created through the Framer B.V. registrar, consistent with the .framer.app sub‑domain namespace. Nameserver information is not publicly available, as the query returned NS_NOT_FOUND. The domain has been flagged by multiple threat intelligence feeds: it appears on two public blocklists and is explicitly blocked by both PhishDestroy and OpenPhish, confirming that security vendors have observed malicious activity associated with this host.

VirusTotal reports that 15 of 91 scanning engines have marked the domain as malicious, providing additional corroboration of its phishing intent. No public page title or SSL certificate data have been disclosed, and HTTP response details are not available, limiting visibility into the exact payload served to victims. Given the convergence of these indicators—active resolution, registrar linkage to a known hosting service, detection by a sizable subset of antivirus scanners, and inclusion on reputable phishing blocklists—defenders should treat traffic to this domain as hostile.

Recommended mitigation steps include immediate DNS or proxy level blocking of the domain and its resolved IP address, updating intrusion detection signatures to flag outbound connections to 31.43.160.6, and adding the host to internal blocklists. Continuous monitoring of the IP for any shift in hosting patterns or new associated domains is advised, as threat actors often pivot infrastructure to evade takedown efforts. Organizations should also educate end users about the presence of newly observed phishing domains, reinforcing cautious handling of unsolicited communications that could direct victims to this URL.