good-someone-505727[.]framer[.]app

The domain good-someone-505727.framer.app is identified as a brand impersonation phishing site targeting the Optus brand. The domain is currently offline, having been taken down as part of a security response. This report provides a detailed analysis of the domain's infrastructure and threat indicators.

Infrastructure analysis reveals that the domain good-someone-505727.framer.app was registered through CSC Corporate Domains, Inc. on October 02, 2020. The domain resolves to the IP address 52.223.52.2, which is located in the United States and is part of the AS16509 network operated by Amazon.com, Inc. The SSL certificate for the domain is issued by Let's Encrypt. According to VirusTotal, the domain has been flagged by 15 out of 95 security vendors, indicating a significant level of suspicion. Additionally, the domain appears on two security blocklists, PhishDestroy and PhishingDB, further corroborating its malicious nature.

The current status of good-someone-505727.framer.app is offline, which suggests that it has been taken down or is no longer operational. Despite this, users and organizations should remain vigilant to prevent any residual impact or potential reactivation. It is recommended that security teams update their blocklists and continue monitoring for any related activity. Users should be educated to recognize and report any similar domains that may attempt to impersonate legitimate brands like Optus.