webmailswiftsandtelstra[.]deno[.]dev

Analysis of webmailswiftsandtelstra.deno.dev shows that the domain is currently offline and returns a 404 response with the page title “Site Not Found | Framer”. The host resolves to 52.223.52.2, an address owned by Amazon.com, Inc. (AS16509) in the United States, indicating the use of Amazon’s Deno Deploy service. The TLS certificate is issued by Let’s Encrypt (E7) and the site advertises HSTS, confirming that HTTPS was enforced when the site was reachable. The registrar information points to Tucows Domains Inc., and the authoritative name servers are Google Cloud’s ns‑cloud‑c1‑c2‑c3.googledomains.com, consistent with a typical cloud‑based deployment.

The domain was created on 28 February 2019, and VirusTotal records show that 14 of 95 scanned security vendors flagged the host, a level that aligns with the “elevated” risk rating. The domain appears on a single public blocklist and is specifically listed by PhishDestroy as a credential‑phishing vector. No additional payload or page content has been captured beyond the generic 404 title, so the exact phishing landing page cannot be confirmed.

Defenders should continue to block the domain and its resolved IP address, add the host to internal URL filtering rules, and monitor for any re‑activation or similar sub‑domains using the same Deno Deploy infrastructure. Ongoing observation of the Amazon AS16509 range for new domains that resolve to the same IP may reveal future campaigns. Because the site is presently taken offline, immediate incident response is limited to preventive controls rather than remediation of compromised user credentials.