This Framer-hosted subdomain is a credential phishing page built to pass as a Spectrum account sign-in. The words "secure-id" and "spectrum-net-login" in the hostname are meant to look like an official identity portal to anyone who glances at the address bar. PhishDestroy first saw it on 2026-08-13. It went offline on 2026-08-15 and was still dead at the last check on 2026-10-19, so it was live for only a short window.
How the scam works
Victims usually arrive through a link in an email or text that warns about a billing problem, a suspended service or a security check on their Spectrum account. The page asks for a username and password, and sometimes payment or personal details, then passes everything to the operator. With those credentials an attacker can take over the email and ISP account, reset passwords on other services tied to that address, and run further fraud in the victim's name. The page currently shows the title "Site Not Found | Framer", which reflects the removed site rather than the Spectrum phishing content we classified.
Evidence
On 2026-08-17, after the page had already gone down, 20 of 91 VirusTotal engines flagged it. The vendors included BitDefender, ESET, Emsisoft, Forcepoint ThreatSeeker, Criminal IP, alphaMountain.ai, CRDF and CyRadar. That spread across established antivirus and web-filtering vendors is strong independent support for the phishing classification. PhishDestroy also lists the domain on its own blocklist.
Infrastructure
The operator did not register a domain of its own. The page sat on a free subdomain of the Framer website builder, so it inherited the platform's registrar, CSC Corporate Domains, Inc., and the platform's TLS certificate. Traffic resolved to Amazon infrastructure in the Netherlands. This setup costs almost nothing, produces a working HTTPS padlock right away, and can be replaced as soon as one page is taken down.
What to do
If you entered your Spectrum login on this page, change that password now from Spectrum's official site or app. Change it anywhere else you reused it, and turn on two-factor authentication. Check your account for changed contact details, new devices or unfamiliar payment activity. If you submitted card details, contact your bank. Defenders should block Framer subdomains that combine ISP brand names with login wording, and should search mail logs for messages linking to this hostname.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(US)
