able-neptune-166625[.]framer[.]app

This domain is flagged for elevated risk due to credential theft activity targeting users of AR24, a French registered mail service. Analysis indicates the page impersonates AR24’s "Courriel recommandé" (registered mail) portal, likely to harvest login credentials or personal data under false pretenses. The threat type is classified as credential theft, not generic phishing, due to the targeted impersonation of a specific brand’s authentication workflow. Infrastructure analysis reveals the domain was registered through Framer on April 26, 2026, and resolves to IP 31.43.160.6, located in the Netherlands. The SSL certificate is issued by Let’s Encrypt (serial E8), a common choice for both legitimate and malicious sites. The domain appears on one security blocklist and is flagged by 19 out of 95 security vendors on VirusTotal. While the domain is currently offline, its prior activity and technical indicators align with credential harvesting campaigns. Mitigation steps for this threat type include immediate revocation of any credentials entered on the site, particularly for AR24 or related email services. Users should enable multi-factor authentication (MFA) on all accounts associated with the impersonated brand. Network-level protections should block the domain and its resolving IP (31.43.160.6) at firewalls or DNS filters. Organizations should monitor for anomalous login attempts from the Netherlands or Framer-hosted domains. If the domain reactivates, security teams should treat it as a high-priority credential theft indicator and conduct internal audits for compromised accounts.