telsstrawebmailsservicesdeskau[.]framer[.]website

The domain telsstrawebmailsservicesdeskau.framer.website was observed as an offline credential phishing site targeting Telstra customers. Registration data shows the domain was created on November 19, 2021 through CSC Corporate Domains, Inc., and it is hosted on Amazon’s infrastructure (AS16509) in the United States, resolving to IP address 35.71.142.77. The authoritative name servers are ns-1243.awsdns-27.org, ns-1818.awsdns-35.co.uk, ns-336.awsdns-42.com and ns-792.awsdns, all indicating reliance on AWS DNS services. TLS was supplied by Let’s Encrypt (certificate identifier E7), and the site advertised HSTS and HTTP/3 support, consistent with modern web‑app frameworks.

Page metadata captured a title of “Sign in with your Telstra ID”, directly aligning with the declared impersonation of Telstra and the credential‑phishing classification. An HTTP request returned a 404 status, and the site is presently taken offline, as confirmed by its removal from service and its inclusion on the PhishDestroy blocklist. VirusTotal scans recorded ten detections out of ninety‑five security vendors, reinforcing the malicious assessment.

The domain appears on a single external blocklist, suggesting limited but non‑trivial exposure. Defenders should continue to block the domain at network perimeter and DNS layers, monitor the associated IP for any future re‑use, and enforce user awareness training that warns against unsolicited Telstra login prompts. Additional investigative steps include reviewing any historic traffic logs for connections to the listed IP and confirming that no active phishing payloads remain cached on client devices.