telstraswiftwebmail[.]framer[.]website

Analysis of telstraswiftwebmail.framer.website shows a domain created on 21 February 2026 and currently taken offline. The domain resolves to 52.223.52.2, an Amazon Web Services host located in the United States under ASN 16509. Nameservers are ns-1243.awsdns-27.org, ns-1818.awsdns-35.co.uk, ns-336.awsdns-42.com, confirming use of AWS Route 53. The site presented a 404 HTTP response and the page title returned “Site Not Found | Framer”, indicating the underlying Framer hosting service. SSL is provided by Let’s Encrypt with certificate identifier E7, and transport security includes HSTS and HTTP/3. Technology fingerprints list Framer Sites, React, and modern protocol support.

Registration records list CSC Corporate Domains, Inc. as the registrar. Threat intelligence classifies the domain as credential phishing, and VirusTotal records nine detections out of ninety‑five scanning engines. The domain appears on a single security blocklist and is listed as blocked by PhishDestroy. The low detection count (nine of ninety‑five) suggests limited exposure, but the presence on a blocklist confirms malicious use. No safe‑browse or OTX entries were observed, and no additional intelligence about phishing kits or credential drops is available.

Because the domain leverages a legitimate Framer service, reputation signals may be obscured, making static URL filtering essential. Defenders should block the resolved IP address and associated AWS name server prefixes, deny TLS connections to the Let’s Encrypt certificate, and add the domain to URL filtering rules. Continuous monitoring of AWS‑hosted infrastructure and related subdomains is advised, as the attacker may repurpose the same hosting configuration for future campaigns. Organizations should also inspect outbound traffic for connections to the IP address 52.223.52.2 and consider implementing threat‑intel feeds that contain the associated AWS name servers.