shaggy-variation-568526[.]framer[.]app

Analysis of shaggy-variation-568526.framer.app shows a domain that was created on October 02, 2020 and is presently taken offline. The site returned an HTTP 404 status and presented a TLS certificate issued by Let’s Encrypt with the E7 identifier, indicating a short‑lived, automatically‑generated certificate. The page title observed during the brief probe was "Login Screen," and the domain is explicitly linked to a brand impersonation of AT&T. Hosting is provided by Amazon.com, Inc. under ASN 16509, with the endpoint resolving to IP address 52.223.52.2 located in the United States. DNS resolution is handled by four AWS name servers (ns-625.awsdns-14.net, ns-2002.awsdns-58.co.uk, ns-1371.awsdns-43.org, ns-51.awsdns-). The underlying web stack includes Framer Sites, React, HTTP/3, and HSTS, consistent with a modern static‑site generation platform rather than a traditional credential‑harvesting service.

Security telemetry indicates that the domain is listed on a single blocklist and has been flagged by PhishDestroy. VirusTotal scans returned 13 positive detections out of 95 vendor submissions, confirming that multiple security products consider the domain malicious. The registrar listed for the registration is CSC Corporate Domains, Inc., a known bulk‑registration service.

While the offline status limits current interaction, the combination of brand impersonation, malicious detection counts, and active blocklisting suggests a credible threat vector aimed at credential collection against AT&T customers. Defenders should ensure that the domain is added to outbound filtering rules, monitor DNS queries for the associated IP and name servers, and correlate any internal alerts that reference the observed page title or the specific TLS fingerprint. Continued observation of the registrar and hosting ASN for new subdomains is advisable, as adversaries may reuse the same infrastructure for future campaigns.