io-startedtrezro[.]framer[.]ai

Analysis of the domain io-startedtrezro.framer.ai indicates a confirmed brand impersonation campaign targeting Trezor, a cryptocurrency hardware wallet provider. The domain, registered on January 6, 2018, was operational until recently and hosted on infrastructure associated with Amazon.com, Inc. (AS16509) in the Netherlands, resolving to IP address 31.43.160.6. The page title, 'TréŻor.io/start — Reliable Way to Secure Digital Assets,' explicitly references Trezor, reinforcing the impersonation intent. Technologies detected include Framer Sites, React, HSTS, and HTTP/3, with a Let's Encrypt SSL certificate issued under the E8 intermediate.

The domain is currently offline, returning an HTTP 404 status. Security vendors have flagged this domain on multiple blocklists, including PhishDestroy, MetaMask, and SEAL. Nine out of 91 security vendors on VirusTotal detect the domain as malicious, and it appears on three additional security blocklists. The domain's Gridinsoft trust score is 0/100, further corroborating its malicious classification.

Nameservers are hosted under AWS (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns), and the domain was registered through CSC Corporate Domains, Inc. While the exact content and functionality of the phishing page remain unanalyzed due to its current offline status, the available evidence—including the page title, brand target, and detection by multiple security vendors—confirms its role in a Trezor impersonation scheme. Defenders should treat this domain as confirmed malicious infrastructure and ensure it is blocked at the network and endpoint levels. Organizations using Trezor products should monitor for user reports of exposure to this domain and consider proactive communication to users about the risks of interacting with unofficial Trezor-related sites.