thistle-closet-933522[.]framer[.]app

Analysis of thistle-closet-933522.framer.app indicates that the domain was registered on 2026-02-21 through CSC Corporate Domains, Inc. and is hosted on Amazon's infrastructure (AS16509) in the Netherlands, resolving to IP 31.43.160.6. The site presented a 404 HTTP status with the page title “Site Not Found | Framer”, and the underlying stack was identified as Framer Sites built on React with HSTS and HTTP/3 enabled. The TLS certificate is issued by Let’s Encrypt (E7), confirming that encrypted connections were available while the domain was live. Reputation data shows a Gridinsoft trust score of 0/100 and the domain appears on a single security blocklist, currently blocked by PhishDestroy.

VirusTotal scans recorded 17 detections out of 93 vendors, reinforcing the malicious assessment. The domain is presently offline, and the risk level has been classified as elevated. The available evidence points to a generic phishing operation, but no specific target brand or payload details have been recovered from the page content. Uncertainty remains regarding the exact phishing lures used, the presence of credential‑harvesting forms, or any associated command‑and‑control infrastructure, as the site returned only a not‑found page.

Defenders should immediately add the domain and its resolving IP to outbound filtering rules and update DNS blocklists. Continuous monitoring of the IP range and of other subdomains under framer.app is advised, as threat actors frequently recycle similar hosting patterns. Where possible, ingest the detection signatures from the 17 VirusTotal vendors into endpoint and network detection systems. Given the low trust score and blocklist presence, any future resolution of this domain should be treated as malicious and blocked at the perimeter.