us-trezor[.]framer[.]ai

The domain us-trezor.framer.ai is flagged as a brand-impersonation site targeting the cryptocurrency hardware-wallet provider Trezor. The page title returned by the server is “Official Site® | Trezor.io/start® - Trezor”, which directly references the legitimate brand. An HTTP request yields a 404 status, indicating that the content is no longer publicly reachable, and the domain has been taken offline. Infrastructure analysis shows the domain resolves to 31.43.161.6, an address owned by Amazon Web Services (ASN 16509) located in the Netherlands. The SSL certificate is issued by Let’s Encrypt and carries the identifier “E8”, confirming the use of a free, automated certificate.

DNS is served by four AWS name servers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns). The site was registered on 6 January 2018 through CSC Corporate Domains, Inc., and the registrar information has not changed since creation. Security-vendor scans on VirusTotal report that three of ninety-one AV engines flagged the domain, and three independent blocklists have already listed it. It is also blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the consensus that the domain is malicious. The hosting stack includes Framer Sites, React, HTTP/3, and HSTS, which are typical of modern web applications but do not mitigate the impersonation risk.

Gridinsoft assigns a trust score of 0 / 100, reflecting a highly untrusted reputation. Uncertainty remains regarding the exact payload or credential-harvesting mechanisms, because the site is currently offline and no page capture is available. Defenders should continue to block the domain at perimeter and DNS filters, monitor the associated IP address for any re-use, and add the certificate fingerprint to TLS inspection rules.