marvelous-state-083672[.]framer[.]app

This domain, marvelous-state-083672.framer.app, is flagged as an elevated-risk credential theft phishing campaign. Analysis indicates the page mimics a login screen to harvest user credentials, a common tactic in account takeover schemes. The threat type is narrowly defined as credential theft, distinct from broader phishing or crypto-draining activities, based on the observed page title and infrastructure patterns. Infrastructure analysis reveals the domain resolves to IP 35.71.142.77, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. The domain was registered through CSC Corporate Domains, Inc. on October 02, 2020, though the phishing content appears to be a recent deployment. Detection metrics show 14 out of 95 security vendors on VirusTotal flag the domain, while it is also listed on two blocklists: PhishDestroy and PhishingDB. The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for both legitimate and malicious sites due to its accessibility. The domain has since been taken offline, though residual risk may persist for users who interacted with it prior to deactivation. Mitigation for credential theft phishing requires immediate action from affected parties. Users who entered credentials on the site should assume compromise and rotate passwords for all associated accounts, prioritizing email and financial services. Organizations should deploy multi-factor authentication (MFA) to mitigate unauthorized access, even if credentials are exposed. Network-level protections, such as DNS filtering or endpoint detection rules, should block the domain and its resolving IP (35.71.142.77) to prevent further exposure. Security teams are advised to monitor for follow-up attacks, such as spear-phishing or lateral movement, using the harvested credentials. Given the domain's registration history, vigilance for similar campaigns leveraging the same registrar or hosting provider is recommended.