dom-trust-wet[.]framer[.]ai

Analysis of dom-trust-wet.framer.ai indicates active infrastructure supporting a high‑risk generic phishing campaign. The domain was registered through Framer B.V., but its authoritative nameservers could not be resolved (NS_NOT_FOUND), suggesting the use of non‑standard DNS configurations or dynamic hosting. Network resolution points to the IPv4 address 31.43.160.6, which is presently online and hosts the malicious site.

Reputation data shows the domain is listed on three security blocklists and is explicitly blocked by the PhishDestroy, MetaMask, and SEAL filtering services, confirming that multiple independent threat‑intel feeds have identified it as malicious. A VirusTotal scan involving 91 anti‑malware engines produced no detections; however, this absence of alerts does not equate to safety and may reflect evasion techniques or limited visibility. No SSL certificate details, HTTP response codes, page title, or Safe Browsing/Otx entries are available in the current intelligence set, leaving the exact content and delivery mechanisms undocumented.

Defenders should immediately add dom-trust-wet.framer.ai to network deny lists, monitor DNS queries for the associated IP, and enforce endpoint URL filtering to preempt credential harvesting. Continuous re‑evaluation is advised, as threat actors may alter hosting or page characteristics while retaining the same domain infrastructure.