particular-accessibility-088192[.]framer[.]app

This domain, particular-accessibility-088192.framer.app, is identified as a brand impersonation threat specifically targeting Microsoft Outlook users. Analysis confirms the domain hosted a fraudulent login page titled 'Sign in - outlook,' designed to harvest credentials by mimicking legitimate Microsoft authentication portals. The current status of the domain is offline, though prior activity indicates a focused effort to deceive enterprise and individual users into disclosing sensitive login information. Infrastructure analysis reveals the domain was registered through CSC Corporate Domains, Inc. on February 21, 2026, and resolved to the IP address 35.71.142.77, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509) in the United States. Security vendor assessments on VirusTotal indicate that 20 out of 95 engines flagged the domain as malicious, while it appears on at least one security blocklist. The SSL certificate, issued by Let's Encrypt (serial number E7), provided a false sense of legitimacy to potential victims. The creation date, combined with the rapid detection and takedown, suggests a short-lived but high-risk operation. The domain has since been taken offline, likely due to intervention by security providers or hosting infrastructure. However, the technical indicators associated with this threat—including the IP address, SSL certificate details, and registrar information—remain relevant for detection and prevention. Organizations are advised to block the domain and its resolving IP at the network perimeter, update endpoint protection signatures, and monitor for any residual connections or similar impersonation attempts. Users who may have interacted with the domain should reset their credentials immediately and enable multi-factor authentication on all accounts. Proactive hunting for related artifacts, such as the page title 'Sign in - outlook' in web logs, is recommended to identify potential compromise.