trazorstart[.]framer[.]ai

The domain trazorstart.framer.ai is currently listed as offline but exhibits multiple technical indicators consistent with a brand‑impersonation campaign targeting Trezor users. Registration data shows the domain was created on January 06, 2018 through CSC Corporate Domains, Inc., and it is hosted on Amazon’s infrastructure (ASN 16509) with the IP address 31.43.161.6 located in the Netherlands. The domain resolves to four AWS name servers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns), a pattern often observed in malicious hosting that leverages cloud services for rapid deployment and takedown. An SSL certificate issued by Let’s Encrypt (type E8) is present, indicating the site was capable of serving HTTPS traffic, and the HTTP response now returns a 404 status, suggesting the content has been removed or the site is being temporarily withdrawn.

The page title that was captured reads “Trezor.io/Start – Official Setup & Secure,” directly mimicking the legitimate Trezor onboarding page and reinforcing the impersonation intent. VirusTotal analysis records five detections out of ninety‑one scanners, confirming that at least a subset of security engines recognize the domain as malicious. Additional defensive feeds have flagged the domain; it appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. The Gridinsoft trust score of 0 / 100 further underscores the high risk associated with the domain.

While the exact phishing payload or credential‑capture mechanism cannot be verified due to the 404 response, the convergence of registration age, cloud hosting, TLS usage, brand‑specific page title, and multi‑vendor detections provides a strong indication of malicious intent. Defenders should add trazorstart.framer.ai to DNS and URL filtering deny lists, monitor the IP address 31.43.161.6 for any re‑activation, and consider broader network‑level blocks for the associated AWS name servers.