magenta-arrow-611200[.]framer[.]app

The domain magenta-arrow-611200.framer.app was identified as a credential harvesting phishing infrastructure targeting Microsoft users. Analysis confirms this as a brand impersonation threat, presenting a fraudulent Xfinity Sign In page to deceive victims into submitting login credentials. The domain is currently offline, though prior activity indicates a focused campaign against enterprise and consumer accounts. Infrastructure analysis reveals the domain was registered on February 21, 2026, through CSC Corporate Domains, Inc., and secured with a Let's Encrypt SSL certificate (serial E7). It resolved to IP address 52.223.52.2, hosted on Amazon Web Services (AS16509) in the United States. Security telemetry shows the domain was flagged by 19 of 95 vendors on VirusTotal, with one confirmed entry on a security blocklist. The page title, Xfinity Sign In, contradicts the claimed Microsoft impersonation, suggesting either misdirection or a multi-brand attack vector. Current status indicates the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Organizations are advised to monitor for credential reuse, particularly for Microsoft and Xfinity accounts, and to review logs for connections to 52.223.52.2 between February 21 and the takedown date. Security teams should update blocklists with the domain and IP, and consider implementing multi-factor authentication as a mitigation against harvested credentials. No further activity has been observed, but vigilance is recommended given the domain's prior operational state.