glowing-travelers-307979[.]framer[.]app

This domain is flagged at an elevated risk level for brand impersonation targeting Microsoft. Analysis indicates the site was designed to mimic legitimate Microsoft properties, likely to facilitate credential harvesting or unauthorized account access under the guise of official branding. Infrastructure analysis reveals the domain was registered on February 21, 2026, through CSC Corporate Domains, Inc. It resolves to IP address 35.71.142.77, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The domain appears on one security blocklist, and 20 out of 95 security vendors on VirusTotal have detected malicious activity associated with it. The SSL certificate is issued by Let's Encrypt (serial number E7), and the page title was identified as 'My Framer Site.' The domain has since been taken offline, though prior activity suggests it was operational for a limited period. Mitigation steps for this threat type include blocking the domain and associated IP (35.71.142.77) at the perimeter firewall level. Security teams should review logs for connections to this domain or IP, particularly from endpoints that may have interacted with Microsoft-related services. If credential exposure is suspected, affected accounts should be flagged for password resets and multi-factor authentication enforcement. Additionally, monitoring for similar domains registered through the same registrar or resolving to the same IP range is recommended to identify potential follow-up campaigns.