soft-side-946015[.]framer[.]app

The domain soft-side-946015.framer.app is flagged as a generic phishing site and is currently taken offline. Registration records show the domain was created on October 02, 2020 through CSC Corporate Domains, Inc., and it is served by four Amazon Route 53 name servers: ns-625.awsdns-14.net, ns-1371.awsdns-43.org, ns-2002.awsdns-58.co.uk, and ns-51.awsdns-. The hosting IP resolves to 52.223.52.2, which belongs to Amazon.com, Inc. (ASN 16509) and is geolocated in the United States. The site presents an SSL certificate issued by Let’s Encrypt with the identifier “E7”, confirming that TLS is active and HSTS is enforced.

HTTP probing returned a 404 status code, indicating the requested resource is not present, and the page title reported by the scanner is “BT”. Technical fingerprints reveal the use of Framer Sites, a React‑based front‑end, and support for HTTP/3, which are consistent with modern web‑app deployments but do not provide insight into malicious intent. Threat intelligence shows the domain appears on one security blocklist and has been explicitly blocked by PhishDestroy. VirusTotal analysis returned 13 positive detections out of 95 scanned engines, reinforcing the phishing classification.

No additional public intelligence such as OTX or Safe Browsing entries were observed. Given the available evidence, defenders should continue to block the domain at network perimeter and DNS layers, update any automated URL filtering lists with the observed indicator, and monitor for re‑appearance of the host on other blocklists. Because the site is offline, active exploitation cannot be confirmed, but the combination of registration details, blocklist presence, and multiple vendor detections justifies maintaining an elevated risk posture. Further investigation would be required to capture the page content before takedown, which could reveal the specific credential‑harvesting technique employed.