webmail-spectrum-net-login1.framer.website
Category: Phishing
- Don't sign in or pay here. Close it. If you typed a password, change it where you normally use it.
- Already visited? Check your device. A free scan shows whether anything was installed.
- Stop the next one. Combo Cleaner's web protection blocks phishing and scam sites before they load.
Combo Cleaner is PCrisk's own anti-malware tool, owned by RCS LT. Free to scan; removing what it finds needs a licence (7-day free trial).
Quttera Web Malware Removal is a paid subscription service. Pricing, plans, and trial availability are set by Quttera. Quttera is operated by Quttera Ltd, an independent third-party company unrelated to RCS LT. PCrisk.com may earn a referral commission when users sign up through this link.
Description of webmail-spectrum-net-login1.framer.website
This domain appears to host a web page titled "Sign into Webmail" that presents itself as an email login portal. Based on the screenshot, it uses Spectrum branding and mimics the layout of a customer sign-in page, including username and password fields, support-style footer links, and branding associated with Charter Communications.
However, the site is hosted on a Framer subdomain rather than on an apparent official Spectrum-owned domain. The combination of a third-party site builder subdomain, a login-focused page title, and branding that resembles a major telecommunications provider suggests the page may be intended to collect account credentials rather than provide a legitimate customer service portal.
The domain itself, webmail-spectrum-net-login1.framer.website, appears structured around keywords associated with webmail access and a known brand, which is commonly seen in look-alike login pages. Based on the available content and naming pattern, this site appears to be best categorized as a phishing-style credential capture page rather than a standalone business or informational website.
Safety Assessment for webmail-spectrum-net-login1.framer.website
Scan results indicate multiple cautionary signals at the time of this scan. The domain was flagged by 2 out of 91 security engines, including one phishing classification and one suspicious classification. In addition, a malware scan marked the page and related resources as suspicious, and one threat database listing associated the domain with malicious behavior. While some of the flagged resources are standard assets served from the hosting platform, the overall pattern is more concerning because the page is a login form that appears to imitate a recognizable telecom/webmail brand.
The strongest concern is the page’s apparent resemblance to a Spectrum sign-in portal while being hosted on a framer.website subdomain rather than an apparent official brand domain. That kind of branding mismatch may indicate a look-alike page designed to capture usernames and passwords. Blacklist data was mixed: several major threat databases were clean at the time of this scan, but the domain's IP address is listed on one mail-reputation blocklist, which is a weaker signal on its own and does not by itself prove harmful website content.
Taking the scan detections, the credential-harvesting style page design, and the brand-like naming pattern together, this website may pose potential risks to visitors, especially anyone considering entering login credentials. Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site was reachable over HTTPS with a valid Let's Encrypt certificate that, at the time of this scan, was set to expire on 2026-11-25. It is hosted on infrastructure attributed to Framer B.V, using the web server identifier "Framer/26fa766," with an IP address located in Amsterdam, Netherlands. The domain uses AWS nameservers and its DNSSEC status appears to be unsigned.
From a security-review perspective, the main technical concern is not the TLS setup but the hosting context and page purpose: a branded login page on a third-party Framer subdomain can be consistent with impersonation or phishing workflows. DNSSEC not being enabled is fairly common and is not, by itself, evidence of abuse, but it also does not add extra DNS-layer assurance.
Share your experience with this website. Was it safe? Did you encounter any issues?