trezorsecure[.]framer[.]ai

Analysis indicates that the domain trezorsecure.framer.ai resolves to the IPv4 address 31.43.160.6, hosted on Amazon Web Services (AS16509) in the Netherlands. The domain was registered on 2018-01-06 through CSC Corporate Domains, Inc., and uses four AWS‑managed name servers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns). The TLS certificate is issued by Let’s Encrypt (E8), but the web server returns HTTP 404, suggesting the landing page is no longer reachable. The page title that was observed earlier reads “Trezor.io/start — Secure Your Crypto Wallet Easily”, indicating an attempt to impersonate the official Trezor brand. The classification in the intelligence set lists the scam type as brand impersonation, targeting Trezor users. Reputation signals are strongly negative.

The domain appears on three security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0 / 100, reflecting a lack of legitimacy. VirusTotal analysis shows that two out of ninety‑one scanners flagged the domain, confirming malicious intent. The current operational status is “taken offline”, which aligns with the 404 response but does not guarantee that the infrastructure cannot be re‑activated. Uncertainties remain regarding the exact payload or credential‑harvesting mechanism that may have been hosted when the site was live, as no content was captured in the available data.

The presence of a legitimate‑looking page title suggests a possible credential‑stealing page, but the absence of a reachable page prevents verification. Defenders should continue to block trezorsecure.framer.ai at network and endpoint layers, monitor for any resurgence of the domain or associated IP address, and add the IP 31.43.160.6 to deny‑list rules. Given the AWS hosting, consider notifying the Amazon abuse team with the evidence of brand impersonation.