purple-lifecycle-583172[.]framer[.]app

Analysis of purple-lifecycle-583172.framer.app shows a short‑lived infrastructure that was used to impersonate BT credentials. The domain was registered on February 25, 2026 through CSC Corporate Domains, Inc. and resolves to the Amazon‑owned IP address 31.43.161.6, which is hosted in the Netherlands under ASN 16509. The site presented an HTTPS certificate issued by Let’s Encrypt (type E7) and advertised HTTP Strict Transport Security (HSTS) and HTTP/3, indicating a modern web stack. Automated fingerprinting identified Framer Sites and React as the underlying technologies, consistent with a template‑driven phishing kit.

The HTTP response returned a 404 status, and the page title captured by scanners is “Saisie de votre identifiant Orange”, suggesting a French‑language credential‑capture page possibly targeting Orange customers rather than BT, though the threat intelligence flags the campaign as a BT brand impersonation. The domain’s authoritative name servers are ns-1371.awsdns-43.org, ns-2002.awsdns-58.co.uk, ns-51.awsdns-06.com, and ns-625.awsdns‑ (truncated), all belonging to Amazon Route 53. VirusTotal recorded 16 detections out of 93 scanning engines, and the domain appears on one external security blocklist.

PhishDestroy has already taken the site offline, and current status is reported as offline. Defenders should add the domain and its resolving IP 31.43.161.6 to URL and IP blocklists, monitor for future domains registered by the same registrar or hosting on the same AWS region, and watch for replication of the Framer‑React template that may be reused in subsequent campaigns. Continuous threat‑intel feeds should be consulted for any resurgence of similar BT‑targeted lures, especially those that reuse the “Saisie de votre identifiant Orange” page title or similar French‑language prompts.