moccasin-absolute-605532[.]framer[.]app

This domain, moccasin-absolute-605532.framer.app, is identified as a credential harvesting phishing site designed to deceive users into submitting sensitive login credentials. The site presents a fraudulent interface resembling legitimate services, likely targeting users through social engineering tactics such as fake login prompts or urgent account verification requests. Once credentials are entered, they are transmitted to threat actors for unauthorized access, financial fraud, or further exploitation. Analysis indicates the domain is hosted on infrastructure associated with a known content delivery platform, registered through Framer. It resolves to the IP address 31.43.161.6, located in the Netherlands under AS16509 (Amazon.com, Inc.). The site was flagged by 18 out of 95 security vendors on VirusTotal, confirming its malicious classification. Additionally, it appears on one security blocklist and uses a Let's Encrypt SSL certificate (YE1), which, while providing encryption, does not validate the site's legitimacy. The page title, My Framer Site, suggests an attempt to blend in with legitimate Framer-hosted projects. If this domain was visited, immediate action is required to mitigate potential compromise. Users should revoke any entered credentials by changing passwords for all accounts where the same or similar login details were used. Enable multi-factor authentication (MFA) on critical accounts to prevent unauthorized access. Scan the device for malware using updated security tools, as phishing sites may deploy additional payloads. Monitor financial and account activity for signs of unauthorized transactions or access. Report the incident to relevant security teams or platforms to assist in further mitigation efforts.