bredge-trzrai[.]framer[.]ai

Analysis of the domain bredge-trzrai.framer.ai, observed on July 22 2026, indicates it was used for a MetaMask brand‑impersonation campaign. The site was hosted on the Amazon AWS infrastructure (AS16509) under the IPv4 address 31.43.160.6, geolocated to the Netherlands. DNS resolution employed four Amazon Route 53 name servers (ns‑1902.awsdns‑45.co.uk, ns‑635.awsdns‑15.net, ns‑1198.awsdns‑21.org, and a fourth entry truncated in the data). The TLS certificate was issued by Let’s Encrypt (E8) and the HTTP response returned a 404 status, suggesting the landing page was removed or never served content.

The page title captured in the scan, “Install Trézór Bridge® | Enable Trusted Crypto #TreZor”, references a cryptocurrency bridge, consistent with the reported brand‑impersonation of MetaMask. Gridinsoft assigned a trust score of 0 / 100, reflecting extreme suspicion. VirusTotal recorded a single positive detection out of 91 scanned vendors, and the domain appears on three independent security blocklists; it is explicitly blocked by PhishDestroy, MetaMask’s own protection services, and the SEAL consortium. Registration information shows the domain was created under the registrar CSC Corporate Domains, Inc. The overall risk rating is elevated, and the current operational status is offline.

Defenders should continue to block the resolved IP and associated ASN, enforce DNS‑level deny rules for the domain, and monitor for any re‑registration attempts. Threat‑intelligence feeds should be updated to include the observed page title and the specific brand‑impersonation indicator to improve detection of similar campaigns. Continuous observation of related subdomains within the framer.ai namespace is recommended, given the use of AWS name servers and the potential for rapid redeployment.