The domain mytalktalkbroadbandserviceforyou.framer.website was created on November 19, 2021 and is currently taken offline, returning an HTTP 404 status. The site was blocked by the PhishDestroy sinkhole and appears on a single security blocklist, indicating that at least one defensive feed has flagged it as malicious. DNS resolution points to the IP address 52.223.52.2, which is hosted in the United States under ASN 16509 owned by Amazon.com, Inc. The domain is delegated to four Amazon Route 53 name servers (ns-1243.awsdns-27.org, ns-1818.awsdns-35.co.uk, ns-336.awsdns-42.com, ns-792.awsdns). Registration was performed through CSC Corporate Domains, Inc., a registrar that is frequently used for bulk domain registrations.
The TLS certificate is issued by Let’s Encrypt (profile E7), confirming that HTTPS is available but does not provide any additional trust. A technology fingerprint shows the presence of Framer Sites, React, HTTP/3, and HTTP Strict Transport Security (HSTS), which are typical of modern web‑app hosting platforms. VirusTotal scans have returned detections from 13 of 95 security vendors, reinforcing the suspicion that the domain is being used for malicious purposes. The only visible page title, “My Framer Site,” offers no indication of a targeted brand or service, and no further content has been captured.
Because the site is offline, direct content analysis is not possible, leaving the exact phishing payload or credential‑harvesting tactics unknown. Defenders should continue to block the domain at the DNS and proxy layers, monitor for any resurgence of the same IP address or name‑server set, and consider adding the IP 52.223.52.2 to reputation‑based blocklists. Additional investigation could include archival crawls to retrieve any previously cached pages and correlation with other domains that share the same registrar or hosting infrastructure.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(US)
