telstraadministrativesupport[.]framer[.]website

The domain telstraadministrativesupport.framer.website was registered on November 19, 2021 through CSC Corporate Domains, Inc. and is hosted on Amazon Web Services (ASN AS16509) in the United States, resolving to IP address 35.71.142.77. The site employs Framer Sites and React, with HSTS and HTTP/3 enabled, and presents a valid Let’s Encrypt (E7) TLS certificate. An HTTP request returns a 404 status, while the page title captured during analysis reads “Sign in with your Telstra ID,” indicating a credential‑phishing attempt targeting Telstra customers.

The domain’s nameserver set includes ns-1243.awsdns-27.org, ns-1818.awsdns-35.co.uk, ns-336.awsdns-42.com, and ns-792.awsdns, confirming use of Amazon Route 53 DNS. VirusTotal scans show eight of ninety‑five security vendors flag the domain as malicious, and it appears on a single public security blocklist. PhishDestroy has also blocked the domain.

The threat is classified as brand impersonation with an elevated risk level, and the infrastructure has been taken offline as of the report date, July 25, 2026. Defenders should continue to block the domain at perimeter controls, monitor for any re‑registration or similar sub‑domains using the same naming pattern, and consider adding the associated IP address and ASN to threat‑intel feeds. Ongoing vigilance for Framer‑based phishing kits targeting Telstra credentials is advised, as the observed technology stack may be reused in future campaigns.