marvelous-software-255300[.]framer[.]app

This domain, marvelous-software-255300.framer.app, is confirmed to host a credential harvesting phishing operation targeting users through deceptive login interfaces. Analysis indicates the site mimics legitimate authentication portals to capture usernames, passwords, and potentially multi-factor authentication tokens, posing a direct risk of account compromise and unauthorized access to sensitive systems. Infrastructure analysis reveals multiple technical indicators supporting this classification. The domain was registered on February 21, 2026, through CSC Corporate Domains, Inc., and resolves to IP address 52.223.52.2 within Amazon.com, Inc.'s AS16509. Security vendors on VirusTotal flagged the domain at a rate of 17/95, while it appears on one known security blocklist. The SSL certificate is issued by Let's Encrypt (serial E7), and the page title observed was 'My Framer Site,' suggesting minimal effort to conceal malicious intent. Users who visited marvelous-software-255300.framer.app should immediately revoke any entered credentials from associated accounts, particularly if reused across services. Enable multi-factor authentication where available and monitor linked accounts for unauthorized activity. Network administrators are advised to block the domain and IP 52.223.52.2 at perimeter controls to prevent further exposure. No further interaction with the domain should occur, as it remains a verified phishing endpoint despite its current offline status.