slight-parts-768408[.]framer[.]app

This domain, slight-parts-768408.framer.app, is identified as a brand impersonation threat targeting BT, a telecommunications provider. Analysis indicates the domain was designed to mimic legitimate BT services, likely to deceive users into disclosing credentials or sensitive information. No cryptocurrency drainer kit or payment diversion mechanisms were explicitly detected in initial scans, but the impersonation framework aligns with credential harvesting tactics. Infrastructure analysis reveals the domain resolves to IP address 35.71.142.77, hosted under AS16509 (Amazon.com, Inc.). The domain is registered through an autonomous system tagged as AT-88-Z, with a Let's Encrypt SSL certificate (serial E7). VirusTotal reports 15 out of 95 security vendors flagging the domain as malicious. It appears on two security blocklists, specifically PhishDestroy and PhishingDB. The page title, 'My Framer Site,' suggests a generic template was used, which is consistent with low-effort phishing campaigns. The domain is currently offline, reducing immediate risk to end users. However, residual threats persist, including potential reuse of the infrastructure or repurposing of the domain. Organizations are advised to monitor for re-emergence, block the domain and associated IP at perimeter defenses, and alert users to verify URLs before entering credentials. Security teams should correlate logs for prior connections to 35.71.142.77 to identify potentially compromised accounts.