functional-gazelle-427024[.]framer[.]app

This domain is flagged for hosting a targeted fake login page designed to harvest banking credentials under the guise of Rogers Communications and Shaw Communications, a recent merger in the Canadian telecommunications sector. The phishing kit mimics the legitimate login portal for customer accounts, increasing the likelihood of credential compromise for users attempting to access billing or service management features. Analysis indicates the threat type aligns with credential theft campaigns observed in regional financial and telecom fraud operations, where stolen logins are later used for unauthorized transactions or identity theft. Infrastructure analysis reveals the domain functional-gazelle-427024.framer.app was registered through Framer, a web development platform often exploited for rapid phishing deployment due to its ease of use and free tier availability. The domain resolves to IP address 31.43.161.6, geolocated in the Netherlands under Amazon.com, Inc. AS16509, a common hosting provider for malicious infrastructure. The SSL certificate is issued by Let's Encrypt (identifier YE1), providing HTTPS encryption to lend false legitimacy to the phishing site. At the time of assessment, 20 out of 95 security vendors on VirusTotal detected the domain as malicious, while it appeared on one security blocklist. The page title, 'Sign in . Rogers together with Shaw,' directly references the impersonated brands, confirming the targeted nature of the attack. Mitigation for this threat involves immediate credential rotation for any users who may have entered login details on the site, particularly those with Rogers or Shaw accounts. Network-level protections should include blocking the domain and its resolving IP (31.43.161.6) at firewalls and DNS resolvers. Organizations should monitor for authentication attempts from the Netherlands (NL) or Amazon AS16509 ranges that lack prior user association. End-user education should emphasize verifying domain legitimacy before entering credentials, especially for pages claiming to represent merged or rebranded services. Security teams are advised to review logs for interactions with functional-gazelle-427024.framer.app or similar Framer-hosted subdomains, as this infrastructure may be reused for future phishing campaigns.