affable-arrow-439402[.]framer[.]app

The domain affable-arrow-439402.framer.app was identified as a credential phishing site impersonating Orange, a telecommunications provider. The page, titled 'Saisie de votre identifiant Orange,' was designed to harvest user credentials through a fraudulent login portal. As of the latest verification, the domain has been taken offline, though prior activity remains under investigation. Analysis indicates the domain was flagged by 18 of 95 security vendors on VirusTotal, with detection labels including generic phishing and brand impersonation. Infrastructure details reveal registration through CSC Corporate Domains, Inc., with a creation date of February 21, 2026. The domain resolved to IP address 52.223.52.2, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. It appeared on one security blocklist, and its SSL certificate was issued by Let's Encrypt (serial number E7). The page title and language suggest targeting of French-speaking users. The domain is currently offline, reducing immediate risk to users. However, organizations should monitor for re-emergence under similar naming conventions or infrastructure. Recommended actions include blocking the domain and associated IP at network perimeters, alerting users to verify login portals directly through official channels, and reviewing logs for prior interactions with this infrastructure. Security teams should correlate indicators with internal telemetry to assess potential compromise.