brave-message-765752[.]framer[.]app

brave-message-765752.framer.app was registered on 21 February 2026 through CSC Corporate Domains, Inc. The domain resolves to 52.223.52.2, an Amazon Web Services address (AS16509, United States). The hosting infrastructure serves content built with Framer Sites and the React framework, and the server advertises HTTP/3 support and HSTS enforcement. SSL is provided by Let’s Encrypt (certificate identifier E7) and the site returns an HTTP 404 status with the page title “Site Not Found | Framer”. VirusTotal analysis shows that 16 of 93 scanning engines flagged the domain, indicating a moderate level of malicious classification. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy sinkhole.

The threat is categorized as brand impersonation, consistent with a generic phishing campaign. Current monitoring indicates the site is offline, and the risk level is assessed as elevated. Defenders should continue to block DNS resolutions to the IP address 52.223.52.2, enforce outbound traffic filtering for the domain, and add the domain to internal deny lists. Because the site is hosted on a shared cloud service, future malicious payloads could be redeployed on the same IP range, so ongoing surveillance of the ASN and related sub‑domains is advisable. The presence of HSTS and HTTP/3 does not mitigate the phishing risk, and the Let’s Encrypt certificate provides only transport security, not content trust.

Organizations should also verify that any user‑reported URLs targeting this domain are quarantined and that email security gateways maintain the PhishDestroy blocklist entry. No public evidence of a landing page or credential‑stealing form has been captured, so the exact phishing template remains unknown. Analysts should treat any future re‑activation of the domain as potentially hostile and monitor for changes in HTTP response codes or content.