eniotrezor[.]framer[.]ai

eniotrezor.framer.ai is currently offline but historical evidence shows it was used for a brand‑impersonation campaign targeting the hardware‑wallet provider Trezor. The domain was registered on 6 January 2018 through CSC Corporate Domains, Inc. and resolves to the IP address 31.43.161.6, which belongs to Amazon.com, Inc. (ASN 16509) and is geolocated in the Netherlands. Four AWS Route 53 nameservers are configured: ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns. The site served an HTTPS certificate from Let’s Encrypt (issuer E8) and advertised modern web stack components including Framer Sites, React, HSTS, and HTTP/3.

An HTTP request returned a 404 status code, indicating the page was not found at the time of testing. The page title returned by the server was “Trézor.io/start | Getting Started | TreZor® (official)”, which directly references the Trezor brand and reinforces the impersonation intent. Reputation services flag the domain as malicious: Gridinsoft assigns a trust score of 0 / 100, three of ninety‑one VirusTotal scanners flagged the domain, and it appears on three public blocklists. It is also listed by PhishDestroy, MetaMask, and SEAL as a known phishing host.

The combination of a brand‑specific title, low trust score, and inclusion on multiple blocklists strongly supports the classification as a brand‑impersonation infrastructure. Because the domain is presently taken offline, active exploitation cannot be confirmed, but the historical footprint suggests it was part of a broader campaign that could be resurrected or copied. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑registration or new subdomains under the same registrar, and consider adding the associated IP address and ASN to threat‑intel feeds. Ongoing observation of the AWS name server set may reveal future re‑use of the same hosting environment for similar impersonation attempts.