en-trezr-wllet[.]framer[.]ai

The domain en-trezr-wllet.framer.ai was observed hosting a page titled "Trezor Wallet – Secure Crypto Storage for Maximum Protection," explicitly referencing the Trezor brand. Registration data shows the domain was created on January 06, 2018 through CSC Corporate Domains, Inc., and it resolves to IP address 31.43.161.6, which is hosted in the Netherlands under ASN 16509 owned by Amazon.com, Inc. The site presented an HTTP 404 response at the time of collection, and the TLS certificate was issued by Let’s Encrypt (certificate identifier E8), indicating the use of a publicly trusted certificate. Infrastructure analysis reveals the presence of Framer Sites, React, HSTS, and HTTP/3 technologies, consistent with a modern web‑application stack.

The domain has a Gridinsoft trust score of 0 out of 100 and appears on three security blocklists; specific blocklist providers include PhishDestroy, MetaMask, and SEAL, all of which have flagged the domain as malicious. VirusTotal scans recorded 19 detections out of 91 security vendors, reinforcing the malicious classification. Current status shows the domain taken offline, but historical evidence confirms it was used for brand impersonation targeting Trezor users.

Defenders should continue to block the domain at network perimeter and DNS layers, monitor the associated IP 31.43.161.6 for any reactivation, and update threat intelligence feeds with the observed indicators. Given the low trust score, multiple vendor detections, and confirmed brand misuse, the domain should be treated as high‑risk infrastructure awaiting potential re‑deployment.