smtptelstrawebmailtelstraswiftwebmailviewswifts[.]framer[.]website

The domain smtptelstrawebmailtelstraswiftwebmailviewswifts.framer.website was created on November 19, 2021 and is currently taken offline, returning an HTTP 404 status. Analysis shows it was hosted on Amazon’s infrastructure (IP 52.223.52.2, ASN AS16509) located in the United States. The registrar entry lists CSC Corporate Domains, Inc., and the domain is served by Let’s Encrypt certificate E7, indicating a valid TLS configuration with HSTS and HTTP/3 enabled. DNS resolution points to four AWS nameservers (ns-1243.awsdns-27.org, ns-1818.awsdns-35.co.uk, ns-336.awsdns-42.com, ns-792.awsdns).

The web stack is identified as Framer Sites using React, matching the technology fingerprint of many credential‑phishing pages. VirusTotal scans have recorded 11 detections out of 95 security vendors, and the domain appears on a single external blocklist. It has been flagged by PhishDestroy and classified as a credential‑phishing campaign impersonating Telstra, with the page title "Sign in with your Telstra ID".

Current uncertainties include the exact content that was served before the site was taken down, as no page capture is available. Defenders should continue to block the domain at network perimeter, monitor for any resurgence of the same host infrastructure, and update URL filtering policies to include the observed domain pattern. Additional threat‑intel sharing with industry partners is advised to ensure broader coverage of this infrastructure.