first-plum-844011[.]framer[.]app

This domain, first-plum-844011.framer.app, was identified as a credential-harvesting phishing site designed to mimic legitimate login portals. Analysis indicates the page likely targeted users by presenting a fraudulent authentication interface, tricking victims into submitting sensitive credentials such as usernames, passwords, or multi-factor authentication codes. The domain's infrastructure and page title, 'My Framer Site,' suggest a hastily deployed attack leveraging a legitimate site-building platform to evade initial detection.

Technical evidence confirms the domain's malicious nature. The site was flagged by 17 out of 95 security vendors on VirusTotal, indicating broad consensus among detection engines. It was registered through Framer, a platform that allows rapid deployment of web pages, which attackers exploited to host the phishing content. The domain resolved to the IP address 31.43.161.6 and was listed on three security blocklists, including PhishDestroy and PhishingArmy. Additionally, the SSL certificate was issued by Let's Encrypt, a common tactic to lend superficial legitimacy to phishing sites. The domain has since been taken offline, but residual risk remains for users who may have interacted with it.

Users who visited first-plum-844011.framer.app or entered credentials on the site should take immediate action. Reset all passwords associated with accounts that may have been exposed, particularly if the same credentials were reused across multiple services. Enable multi-factor authentication (MFA) on critical accounts to mitigate the risk of unauthorized access. Monitor financial and communication platforms for signs of compromise, such as unauthorized transactions or messages. If personal or financial data was submitted, consider reporting the incident to relevant authorities and credit monitoring services to prevent potential identity theft or fraud.