real-effect-585505[.]framer[.]app

This domain, real-effect-585505.framer.app, was observed hosting a credential‑phishing page that mimics Telstra’s login portal, as indicated by the page title “Sign in with your Telstra ID”. The site resolves to the IP address 35.71.142.77, which belongs to Amazon Web Services (ASN 16509) and is geolocated in the United States. The hosting infrastructure is identified as a Framer Sites deployment using React, with HTTP/3 support and HSTS enforced. The TLS certificate is issued by Let’s Encrypt (E7), confirming the presence of HTTPS. According to open‑source scans, the HTTP response returned a 404 status, and the domain is currently taken offline.

Threat intelligence sources have placed the domain on one security blocklist and it is listed as blocked by PhishDestroy. VirusTotal analysis shows that 15 of 95 scanning engines flagged the domain as malicious, reinforcing the suspicion of phishing activity. The registrar entry references “AT‑88‑Z”, reinforcing the association with the AWS ASN. The available data confirm that the domain was used for brand‑impersonation targeting Telstra credentials, but the exact timing of the phishing campaign and the extent of victim exposure remain unknown because the site is no longer reachable and no victim data have been publicly disclosed. No additional evidence such as phishing email samples, URL redirection chains, or malware payloads has been reported.

Defenders should incorporate the domain and its resolved IP address into URL filtering and network‑level blocklists. Because the hosting provider is AWS, security teams may consider applying AWS‑specific threat‑intel feeds to catch related sub‑domains that could be spun up with the same ASN. Updating endpoint detection rules to flag TLS certificates issued by Let’s Encrypt in conjunction with the “framer.app” suffix can help surface similar constructs.