swiftsubreviewwebmail[.]framer[.]website

The domain swiftsubreviewwebmail.framer.website is recorded as an offline credential‑phishing indicator as of 24 July 2026. Infrastructure analysis shows the hostname resolves to the Amazon‑owned address 52.223.52.2, located in the United States under ASN 16509 (Amazon.com, Inc.). The domain was created on 19 November 2021 and is registered through CSC Corporate Domains, Inc., using the authoritative name servers ns-1243.awsdns-27.org, ns-1818.awsdns-35.co.uk, ns-336.awsdns-42.com and ns-792.awsdns.

The TLS certificate is issued by Let’s Encrypt (E7), and the site presents HTTP/3 support, HSTS headers, and a technology stack identified as Framer Sites built on React. An HTTP request returns a 404 status with the page title “Site Not Found | Framer”, confirming that the content is no longer served. VirusTotal analysis recorded 12 detections out of 95 scanned scanners, and the domain appears on a single known blocklist, PhishDestroy, which has already flagged it as malicious.

The available evidence establishes the domain’s use in credential‑phishing campaigns, but the precise phishing kit, targeted brand, or victim interaction flow remain unverified due to the offline status. Defenders should continue to block the domain at DNS and proxy layers, monitor the associated IP address for any resurgence, and consider adding the domain to internal threat‑intel feeds. Ongoing vigilance is recommended to capture any future re‑hosting attempts that might reuse the same registrar or hosting infrastructure.