ioapp-trezo[.]framer[.]ai

Analysis of ioapp-trezo.framer.ai shows the host is presently offline, returning HTTP 404 with the page title “Site Not Found | Framer”. The domain resolves to 35.71.142.77, an address owned by Amazon.com, Inc. (AS16509) located in the United States. DNS is served by three AWS name servers—ns-1902.awsdns-45.co.uk, ns-635.awsdns-15.net, and ns-1198.awsdns-21.org—plus an incomplete fourth entry. The site presented a Let’s Encrypt E8 TLS certificate and advertised modern web technologies including Framer Sites, React, HSTS, and HTTP/3.

VirusTotal recorded six positive detections out of ninety‑three scanned engines, and the domain appears on a single external blocklist. PhishDestroy has actively blocked the host. Registration was performed through CSC Corporate Domains, Inc., a registrar commonly used for bulk or reseller registrations. The observed pattern—short‑lived sub‑domain, legitimate‑looking SSL certificate, and cloud hosting—matches tactics employed in credential‑harvesting campaigns that rely on perceived trustworthiness.

No additional artifacts such as malware hashes, victim reports, or related campaign URLs are currently available, leaving the broader impact of the phishing operation uncertain. Defensive recommendations include maintaining the block on the domain at perimeter filters, monitoring DNS queries for the listed AWS name servers, and adding the IP address 35.71.142.77 to deny‑list rules. Since the site is already offline, focus should be on preventing reuse of the same infrastructure; periodic re‑scans of the domain and its hosting range are advised to detect any future reactivation.