telstrarecoverysystem[.]framer[.]website

This domain, telstrarecoverysystem.framer.website, is flagged as a credential phishing site targeting Telstra customers, as indicated by its page title 'Sign in with your Telstra ID' and confirmed scam type in threat intelligence. Infrastructure analysis reveals the domain was registered on November 19, 2021, through CSC Corporate Domains, Inc., and is hosted on Amazon Web Services (AS16509) at IP 35.71.142.77, located in the US. The site uses nameservers under awsdns (ns-1243.awsdns-27.org, ns-1818.awsdns-35.co.uk, ns-336.awsdns-42.com, ns-792.awsdns) and a Let's Encrypt SSL certificate (E7), which provides no inherent trust signal beyond basic encryption. Technologies detected include Framer Sites, React, HSTS, and HTTP/3, suggesting a modern web stack likely used to mimic legitimate login portals. As of July 23, 2026, the domain returns an HTTP 404 status, indicating it is offline, though this does not preclude future reactivation.

It appears on one security blocklist and was blocked by PhishDestroy. Twelve of 93 security vendors on VirusTotal flagged the domain, though the absence of additional context limits the weight of this detection count. No Safe Browsing or OTX records are referenced in available intelligence. The domain's creation date predates the reported activity by several years, which may reflect either dormant misuse or repurposing of an older domain.

Defenders should treat this domain as elevated risk due to its confirmed credential phishing classification and association with a major telecommunications brand. Recommended actions include blocking the domain and IP at perimeter controls, monitoring for DNS queries or connections to the listed nameservers, and reviewing logs for prior interactions. If the domain reactivates, capture a forensic snapshot of the page content and headers to assess any changes in tactics.