secondupdatenotice.framer.website was a credential phishing page impersonating Spectrum. It targeted Spectrum internet and email customers with a sign-in screen titled "Sign In to Get Started". PhishDestroy first detected it on 2026-08-08. The site has been offline since 2026-09-05, and on our last check on 2026-10-19 its root returned no content.
How the scam works
The subdomain name reads like an account notice, the kind of link sent in a fake "second update" or service warning to push a customer into acting quickly. The victim lands on a page styled as a Spectrum login and is asked to sign in. The username and password go straight to the operators, who can then take over the Spectrum mailbox, reset passwords for other services tied to that address, and use the account for billing fraud or further phishing.
Evidence
On 2026-08-21, 18 of 91 VirusTotal engines flagged the page. Vendors flagging it included alphaMountain.ai, BitDefender, Chong Lua Dao, CRDF, CyRadar, ESET, Emsisoft and Forcepoint ThreatSeeker. Detection from this many unrelated vendors makes a false positive unlikely. urlscan.io independently rated the page malicious and recognized the Spectrum branding, and the domain is listed on the PhishDestroy blocklist.
Infrastructure
The page was built on Framer's site-building platform. The 2021-11-19 registration date belongs to Framer's shared parent domain, not to this campaign, so a long domain history says nothing about this page's legitimacy. Hosting resolved to Amazon.com, Inc. infrastructure in the Netherlands. Free website-builder subdomains let phishers inherit a reputable parent domain and valid HTTPS within minutes, which is why the address alone looked harmless.
What to do
If you entered your Spectrum credentials on this page, change your Spectrum password immediately from the official app or by typing the address yourself. Then change the password on any other account that used the same one. Turn on two-step verification, check your Spectrum email settings for unfamiliar forwarding rules or recovery details, and review recent account activity and billing. Watch for follow-up messages that reference your account, and report them rather than clicking. Defenders should block the hostname, search mail and proxy logs for visits since 2026-08-08, and force credential resets for any user who submitted data.
発行者 Let's Encrypt· stored validity ends in 34 days
Network & certificates
Stored technical evidence
Network & DNS
Resolved IP
31.43.160.6
Network ASN
AS16509
Organization
Framer B.V
Observed location
Amsterdam, NL
Server header
Framer/0ccde4a
ネームサーバー 1
ns-792.awsdns-35.net
Location describes the IP network.
TLS証明書
Issuer
Let's Encrypt
Valid until
2026-09-24 00:00:00
Validity
Stored certificate expired
Collection source
PhishDestroy collector
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
