fresh-principles-727539[.]framer[.]app

This domain is flagged as a confirmed brand impersonation site designed to harvest Microsoft credentials. Analysis indicates a targeted phishing campaign with elevated risk due to its sophisticated infrastructure and direct association with a major technology brand. The threat type is classified as credential theft through brand impersonation, leveraging trusted visual elements to deceive users into submitting sensitive login information. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain fresh-principles-727539.framer.app was registered on February 21, 2026, through CSC Corporate Domains, Inc., and resolves to IP address 52.223.52.2 under Amazon.com, Inc. (AS16509). Security vendors on VirusTotal detected malicious activity, with 20 out of 95 engines flagging the domain. It appears on one security blocklist and was previously blocked by PhishDestroy. The SSL certificate is issued by Let's Encrypt (serial number E7), and the page title was identified as 'My Framer Site,' a common template used to mask phishing content. The domain's current status is offline, though historical activity remains a concern. Mitigation steps for this specific threat type include immediate domain blacklisting in enterprise security gateways and endpoint protection systems. Network administrators should block traffic to 52.223.52.2 and monitor for connections to AS16509 associated with this campaign. Security teams are advised to conduct a retrospective analysis of logs for prior interactions with the domain, particularly focusing on authentication attempts made during its active period. User awareness training should emphasize the risks of brand impersonation on cloud-based hosting platforms, and multi-factor authentication should be enforced for all Microsoft accounts to reduce the impact of potential credential compromise.