mycharterupdatelink[.]framer[.]website

On August 03, 2026, the domain mycharterupdatelink.framer.website was observed in active credential‑phishing infrastructure. The domain is registered through the Framer registrar, a service that provides sub‑domains under the framer.website TLD. VirusTotal reports that 13 of 91 scanned security vendors flagged the domain as malicious, indicating a moderate level of detection consensus. The domain is listed on a single external blocklist and has been explicitly blocked by the PhishDestroy sink‑hole, confirming that threat‑intel feeds have identified it as part of a phishing campaign.

No additional public threat‑intel sources such as OTX or Google Safe Browsing have been referenced for this host, and no page‑title or SSL certificate details have been published in the current intelligence set. Consequently, the precise landing page content, TLS configuration, and hosting IP address remain unknown. Analysis suggests the domain is being used to harvest credentials, likely targeting customers of Charter Communications given the lexical cue “mycharterupdatelink.” The use of a Framer‑provided sub‑domain aligns with a pattern of attackers leveraging free or low‑cost hosting to obscure ownership and evade attribution. The presence of multiple vendor detections and the blocklist entry elevate the risk profile to “elevated,” consistent with the reported status.

Defenders should add mycharterupdatelink.framer.website to URL filtering and email security policies, enforce blocklist updates, and monitor network traffic for DNS queries to the framer.website namespace. Endpoint protection solutions should be configured to treat detections from the 13 reporting vendors as malicious. Where possible, investigators should obtain the hosting IP and TLS certificate to enrich attribution and consider sink‑hole routing for the domain. Ongoing collection of page content, HTTP response codes, and certificate transparency logs is recommended to close current intelligence gaps.