reactivatingsystem[.]framer[.]website

PhishDestroy has identified reactivatingsystem.framer.website as a sophisticated brand impersonation phishing site targeting Telstra customers. The domain was created on November 19, 2021, and registered through CSC Corporate Domains, Inc. It presents a fake login page titled "Sign in with your Telstra ID," designed to steal credentials from unsuspecting users. This threat is particularly dangerous because it mimics a legitimate Telstra authentication portal, potentially capturing sensitive account information.

Technical analysis reveals strong indicators of malicious intent. VirusTotal flagged the domain with 11 out of 95 security vendors marking it as malicious, and it appears on 2 security blocklists. The site uses an SSL certificate issued by Let's Encrypt (E7), which provides a false sense of security through HTTPS. The domain resolves to IP address 35.71.142.77. Although the site has been taken offline, its infrastructure remains a risk for future campaigns.

Any user who visited reactivatingsystem.framer.website and entered their Telstra ID credentials should immediately change their password and enable two-factor authentication on their Telstra account. It is also advisable to monitor for suspicious activity and report the incident to Telstra's security team. For ongoing protection, users should verify all Telstra-related URLs through PhishDestroy's database before entering any login information.