telstraaccountreactivatingsystem[.]framer[.]website

Analysis of telstraaccountreactivatingsystem.framer.website indicates a credential-phishing operation impersonating Telstra, a telecommunications provider. The domain was registered on November 19, 2021, through CSC Corporate Domains, Inc., and is hosted on Amazon Web Services (AS16509) at IP 52.223.52.2, located in the US. Nameservers resolve to AWS DNS endpoints: ns-1243.awsdns-27.org, ns-1818.awsdns-35.co.uk, ns-336.awsdns-42.com, and ns-792.awsdns. The site was configured with a Let's Encrypt SSL certificate (E7) and used technologies including Framer Sites, React, HSTS, and HTTP/3. The page title, 'Sign in with your Telstra ID,' directly aligns with the reported scam type: credential phishing.

As of July 25, 2026, the domain returns an HTTP 404 status and is flagged by 9 of 93 security vendors on VirusTotal, though the specific detection context remains unverified. It appears on one security blocklist (PhishDestroy) and is classified as offline. No additional evidence links or open-source intelligence (e.g., Safe Browsing, OTX) were provided in the available data. The use of Framer Sites, a legitimate web development platform, suggests an attempt to blend malicious activity with trusted infrastructure.

Defenders should treat this domain as a confirmed phishing threat targeting Telstra customers. Block access at network and endpoint levels, and monitor for related domains using the same registrar, hosting provider, or nameserver patterns. If credentials were entered on this site, initiate password resets and enable multi-factor authentication where possible. The domain's current offline status does not preclude future reactivation; continuous monitoring is recommended.