empowered-plum-837415[.]framer[.]app

This domain, empowered-plum-837415.framer.app, is identified as a phishing site specifically designed to impersonate Rogers and Shaw, telecommunications providers. The page title, Sign in . Rogers together with Shaw, directly mimics the legitimate login portal of the merged Rogers-Shaw brand, indicating a targeted credential harvesting operation. Analysis confirms the domain is currently offline, though prior activity suggests an active campaign to deceive users into submitting login credentials under false pretenses. Infrastructure analysis reveals the domain was registered through Framer, a platform commonly used for web design and hosting. The site was flagged by 19 of 95 security vendors on VirusTotal, reflecting moderate to high detection across the security community. It appears on at least one security blocklist, further corroborating its malicious classification. The domain resolved to the IP address 31.43.160.6, a technical indicator that may assist in tracking related infrastructure. No creation date was provided, but the combination of blocklist presence, vendor detections, and brand impersonation aligns with known phishing patterns targeting Canadian telecommunications customers. Current status indicates the domain has been taken offline, reducing immediate risk to end users. However, the underlying infrastructure and impersonation tactics remain a concern. Organizations and individuals are advised to monitor for similar domains registered through Framer or other design platforms, particularly those mimicking Rogers-Shaw branding. Network administrators should update blocklists to include the domain and associated IP address 31.43.160.6. Users who may have interacted with the site should reset credentials immediately and enable multi-factor authentication on all sensitive accounts. Security teams are encouraged to review logs for connections to the domain or IP to assess potential compromise.