spacetelsrawebmail[.]framer[.]website

The domain spacetelsrawebmail.framer.website was observed hosting a generic credential‑phishing campaign and is currently listed as offline with an HTTP 404 response. Infrastructure analysis shows the domain resolves to the IP address 35.71.142.77, which belongs to the Amazon.com, Inc. network (AS16509) and is geolocated in the United States. The domain is delegated to four AWS name servers (ns-1818.awsdns-35.co.uk, ns-336.awsdns-42.com, ns-792.awsdns-35.net, and an incomplete fourth entry), indicating that the hosting environment is Amazon Web Services. The SSL certificate presented is identified as grade E8, suggesting a low‑trust certificate that may not provide strong cryptographic assurances.

Registration data reveals the domain was created on 19 November 2021 and is registered through CSC Corporate Domains, Inc., a registrar known for bulk registrations. The page title returned from the server is "Site Not Found | Framer," which aligns with the 404 status code and confirms that the site is no longer serving malicious content. However, the domain remains flagged by security vendors: fifteen of ninety‑three VirusTotal scanners have reported it as malicious, and it appears on a single external blocklist. PhishDestroy has also added the domain to its blocklist, reinforcing the assessment that it was used for credential‑phishing.

Given the elevated risk rating, defenders should continue to block traffic to this FQDN at network perimeters, update endpoint and web‑gateway signatures to include the domain, and monitor for any re‑registration or the appearance of similarly structured subdomains under the framer.website suffix. Continuous observation of the associated IP range (35.71.142.77) is advisable, as the same AWS infrastructure could be repurposed for future campaigns. The combination of low‑trust SSL, Amazon hosting, and the registrar’s bulk‑registration profile suggests a disposable operational model typical of phishing actors.