slgn-ln-y0ur-rnailb0x-f0r-247up-date[.]framer[.]media

This domain, slgn-ln-y0r-rnailb0x-f0r-247up-date.framer.media, is a credential harvesting site designed to impersonate Microsoft 365 login portals. The page title, 'SlGN lN T0 Y0UR ACC0UNT,' uses character substitution to evade basic text-based detection while presenting a familiar interface to trick users into entering their email credentials. The domain employs social engineering tactics, such as urgency (e.g., '247up-date'), to prompt victims into immediate action, increasing the likelihood of credential compromise. Infrastructure analysis indicates the site was operational for a short period, likely to avoid prolonged scrutiny while maximizing credential collection. Evidence confirms the malicious nature of this domain. It was created on February 21, 2026, and registered through CSC Corporate Domains, Inc., a registrar commonly used for both legitimate and malicious domains. The domain resolves to IP address 35.71.142.77, hosted on Amazon Web Services (AS16509), and uses a Let's Encrypt SSL certificate (serial number E7) to appear legitimate. Security vendors have flagged the domain as malicious, with 21 out of 95 engines on VirusTotal detecting it as a phishing threat. Additionally, it appears on one security blocklist, and the domain has since been taken offline, though residual risk remains for users who may have interacted with it. Users who visited this domain or entered credentials should take immediate action. First, reset passwords for any accounts accessed through the site, prioritizing email and cloud services. Enable multi-factor authentication (MFA) on all critical accounts to mitigate unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or changes to settings. If financial or sensitive data was entered, consider reporting the incident to relevant authorities or identity protection services. Organizations should block the domain and its associated IP (35.71.142.77) at the network level to prevent further exposure. Analyze logs for connections to the domain to identify potentially compromised endpoints.