giant-trip-631671[.]framer[.]app

This domain, giant-trip-631671.framer.app, was identified as a credential phishing site targeting Rogers and Shaw customers, as indicated by the page title 'Sign in . Rogers together with Shaw.' Analysis conducted on July 22, 2026, confirms the domain is currently offline, returning an HTTP 404 status. Infrastructure analysis reveals the site was hosted on Framer’s platform, resolving to the IP address 31.43.160.6, located in the Netherlands under Framer B.V. The SSL certificate was issued by Let’s Encrypt, a common choice for both legitimate and malicious sites, and the domain lacks configured nameservers, which may indicate rapid deployment or takedown efforts. The domain was flagged by one security blocklist and detected by 4 of 91 security vendors on VirusTotal, suggesting moderate but not universal recognition as malicious.

Technologies detected include Framer Sites, React, HSTS, and HTTP/3, which are consistent with modern web development practices but do not inherently indicate malicious intent. The domain was registered through Framer, a legitimate website-building service often abused for phishing due to its ease of use and free tier availability. While the exact content of the phishing page is not analyzed, the page title explicitly references Rogers and Shaw, aligning with the credential phishing classification.

Defenders should treat this domain as part of a targeted campaign against telecommunications customers. Organizations are advised to block access to this domain at the network level, monitor for related indicators of compromise, and alert users who may have interacted with the site prior to its takedown. Given the use of Framer’s infrastructure, additional phishing domains may emerge under similar subdomains or patterns.