memorable-mindset-057912[.]framer[.]app

This domain, memorable-mindset-057912.framer.app, is actively engaged in credential harvesting phishing operations targeting users through deceptive login interfaces. Analysis indicates the site mimics legitimate authentication portals to capture sensitive credentials, including usernames, passwords, and potentially multifactor authentication tokens. The threat is classified as high-risk due to its active status and direct targeting of user authentication data, which can lead to account takeovers, unauthorized access to corporate or personal systems, and subsequent data breaches. Infrastructure analysis reveals the domain is hosted on Framer’s platform, resolving to IP address 31.43.160.6 with a Let’s Encrypt SSL certificate. Google Safe Browsing has flagged the domain under the SOCIAL_ENGINEERING category, while VirusTotal reports 14 out of 95 security vendors detecting malicious activity. The page title, 'My Framer Site,' suggests minimal effort to disguise the phishing content, relying instead on the legitimacy of the Framer.app domain to evade initial suspicion. No historical registration data is publicly available due to the use of a subdomain under Framer’s infrastructure, limiting attribution efforts. Users who have visited memorable-mindset-057912.framer.app or entered credentials on the site should immediately revoke any submitted passwords and enable multifactor authentication on all associated accounts. System administrators are advised to block the domain and its resolving IP (31.43.160.6) at the network perimeter. Affected users should monitor accounts for unauthorized activity and consider resetting credentials for any services where password reuse may have occurred. Security teams should review logs for connections to the domain or IP to identify potential compromise within their environments.