swift-windows-102694[.]framer[.]app

PhishDestroy identifies swift-windows-102694.framer.app as a confirmed brand impersonation phishing site targeting Microsoft. The domain is currently offline, but during its active period it posed an elevated risk to users by mimicking Microsoft to steal login credentials. The threat type is specifically brand impersonation, leveraging the trusted Microsoft name to deceive victims.

Technical indicators are stark: the domain was flagged by 22 of 95 VirusTotal security vendors, and it appears on one security blocklist. It was registered through CSC Corporate Domains, Inc. on February 21, 2026, and resolved to IP address 52.223.52.2. The SSL certificate was issued by Let's Encrypt with serial E7. The page title was simply "My Framer Site," suggesting a hastily constructed phishing page. Despite the low blocklist count, the 22/95 VT detection rate is significant.

Given its current offline status, the immediate risk is mitigated, but users should remain vigilant. PhishDestroy recommends that anyone who visited this domain or entered credentials change their passwords immediately and enable multi-factor authentication. Monitor accounts for suspicious activity. Always verify URLs before entering sensitive information, especially when directed from unsolicited messages.