courteous-takeaways-514228[.]framer[.]app

The domain courteous-takeaways-514228.framer.app was observed as an offline site that previously hosted a brand impersonation campaign targeting Orange. Infrastructure analysis shows the domain resolved to 35.71.142.77, an Amazon Web Services address (AS16509) located in the United States. Registration details indicate the domain was provisioned through the AT-88-Z registrar, and the authoritative name server information was not returned (NS_NOT_FOUND). The site served a TLS certificate issued by Let’s Encrypt (E7), but the HTTP response returned a 404 status code and the page title was reported as "My Framer Site".

Detected technologies include Framer Sites, React, HSTS, and HTTP/3, confirming the use of a modern web‑hosting stack. The domain was listed on a single security blocklist and was actively blocked by the PhishDestroy feed. Reputation scoring from Scamadviser assigned a trust score of 1 out of 100, reflecting extreme suspicion. VirusTotal scans recorded 13 detections out of 95 security vendors, reinforcing the malicious classification.

The available evidence points to a brand‑impersonation scam, yet the exact content of the page at the time of detection has not been captured, leaving the specific phishing vector (e.g., credential‑stealing form, malicious download) unknown. Defenders should continue to block the domain at perimeter controls, monitor related IP ranges for additional Framer‑based infrastructure, and correlate any outbound connections to 35.71.142.77 with user activity logs. Given the low trust score, certificate issuance, and multiple vendor detections, the domain should be treated as high‑confidence malicious, and any residual references in internal systems should be purged or quarantined pending further investigation.