telstrasystemreactivation[.]framer[.]website

Analysis as of 23 July 2026 confirms that telstrasystemreactivation.framer.website is being used for credential phishing targeting Telstra customers. The domain was registered on 19 November 2021 through CSC Corporate Domains, Inc. and resolves to the Amazon‑owned address 52.223.52.2 (AS16509, United States). A Let's Encrypt certificate (E7) is active, and the site presents the title “Sign in with your Telstra ID”, indicating a direct attempt to harvest Telstra credentials. HTTP requests return a 404 status, and the site has been taken offline, but evidence from security feeds shows it was previously reachable.

The hosting stack includes Framer Sites, React, HSTS and HTTP/3, consistent with a modern templated phishing kit. The domain appears on one external blocklist and has been flagged by PhishDestroy. VirusTotal scans reported 12 of 93 security vendors labeling the domain as malicious. Nameservers are ns-1243.awsdns-27.org, ns-1818.awsdns-35.co.uk, ns-336.awsdns-42.com and ns-792.awsdns, confirming use of AWS DNS services.

Uncertainty remains regarding any additional payloads or redirects that may have been delivered before takedown, as the live content is no longer accessible for forensic capture. Defenders should immediately block the domain and the associated IP address, add the domain to internal phishing blocklists, and monitor for other subdomains hosted on the same AWS infrastructure that employ Framer or React templates. Continuous re‑scanning of the IP range and observation of new TLS certificates issued by Let's Encrypt for similar naming patterns are recommended to detect re‑use of the infrastructure.