past-powerpoint-241638[.]framer[.]app

The domain past-powerpoint-241638.framer.app has been identified as a brand impersonation threat targeting Microsoft. The threat is categorized as elevated, indicating a significant risk to potential victims who may be misled into believing they are interacting with a legitimate Microsoft service. No drainer kit has been detected on this domain, suggesting that the primary goal is to gather credentials or sensitive information through a deceptive login page.

Infrastructure analysis reveals that the domain was created on February 21, 2026, and is registered through CSC Corporate Domains, Inc. The domain resolves to the IP address 35.71.142.77, which is located in the United States and is part of the AS16509 network operated by Amazon.com, Inc. The SSL certificate is issued by Let's Encrypt, and the domain has been flagged by 19 out of 95 security vendors on VirusTotal. Additionally, the domain appears on one security blocklist and is currently listed as taken offline by PhishDestroy.

As of the latest assessment, the domain past-powerpoint-241638.framer.app is offline, reducing the immediate risk to users. However, the infrastructure remains in place and could be reactivated at any time. Security teams are advised to monitor the domain and its associated IP for any signs of reactivation. Users are encouraged to verify the URL and SSL certificate when accessing Microsoft services to avoid falling victim to similar impersonation attacks.