telstraautomative[.]framer[.]website

The domain telstraautomative.framer.website was created on 19 November 2021 and is registered through CSC Corporate Domains, Inc. Infrastructure analysis shows the hostname resolves to IP address 52.223.52.2, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The site presents a TLS certificate issued by Let’s Encrypt (E7) and advertises modern web stacks including Framer Sites, React, HSTS, and HTTP/3. The only publicly observable page element is the browser title "Sign in with your Telstra ID," indicating a credential‑phishing attempt targeting Telstra customers.

VirusTotal records show that ten of ninety‑three scanned vendors flagged the domain, and it appears on a single external blocklist. PhishDestroy has also listed the hostname as blocked. The HTTP response at the time of analysis returned a 404 status, and the domain is currently taken offline.

Although the page content has not been captured, the combination of brand impersonation, the title phrasing, and the detection footprint strongly suggests a credential‑phishing campaign. Defenders should add the hostname and its associated IP to network‑level deny lists, monitor for additional domains hosted on the same AWS name‑servers (ns-1243.awsdns-27.org, ns-1818.awsdns-35.co.uk, ns-336.awsdns-42.com, ns-792.awsdns), and watch for new Framer‑based sites that reference Telstra or similar brand identifiers. Continuous re‑scanning of the certificate and periodic checks of VirusTotal and blocklist feeds are recommended to detect any re‑activation of the domain.