determined-click-845532[.]framer[.]app

This domain, determined-click-845532.framer.app, is identified as a credential theft phishing site. The page mimics the login interface of Rogers together with Shaw, a well-known telecommunications brand, to trick users into entering their login credentials. Once entered, these credentials can be captured and used for unauthorized access to user accounts, potentially leading to further fraudulent activities and data breaches.

Infrastructure analysis reveals that the domain was registered through Framer on May 21, 2026, and resolves to the IP address 31.43.160.6, which is located in the Netherlands and associated with Framer B.V. The domain has been flagged by 17 out of 95 security vendors on VirusTotal, indicating a significant level of suspicion. Additionally, the domain appears on one known security blocklist and is blocked by PhishDestroy. The SSL certificate is issued by Let's Encrypt, which, while legitimate, is often used by threat actors to add an air of credibility to their phishing sites.

If users have visited this domain and entered their credentials, they should immediately change their passwords for the Rogers together with Shaw account and any other accounts using the same or similar login information. Users are advised to enable two-factor authentication (2FA) for added security. It is also recommended to monitor account activity and credit reports for any signs of unauthorized access or suspicious transactions. Reporting the incident to Rogers together with Shaw's security team is strongly encouraged to help mitigate potential damage.