shining-whoever-570303[.]framer[.]app

PhishDestroy is tracking an active phishing campaign utilizing the domain shining-whoever-570303.framer.app. This site impersonates a Connexion login page to harvest user credentials. The goal is to trick individuals into entering their usernames and passwords, which are then stolen by malicious actors. This can lead to account compromise, identity theft, and further unauthorized access to sensitive information.

This domain presents a high risk and exhibits several indicators of malicious activity. The domain is currently listed on 3 security blocklists, including OpenPhish, PhishingArmy, and OISD. VirusTotal analysis reveals that 22 out of 95 security vendors have flagged this domain as malicious. The site uses an SSL certificate issued by Let's Encrypt, which is commonly used for both legitimate and malicious purposes, and resolves to the IP address 31.43.161.6. The page title is 'Connexion,' a common lure to deceive users.

Users who have visited shining-whoever-570303.framer.app and entered their credentials should immediately change their passwords on the legitimate Connexion platform and any other accounts where the same password was used. Enable multi-factor authentication wherever possible to add an extra layer of security. Monitor accounts for any signs of unauthorized access or suspicious activity, such as password changes or unusual transactions. Report the incident to the Connexion support team and consider filing a report with law enforcement or a cybercrime reporting agency.