trezo-start-io[.]framer[.]ai

This domain was identified as a high‑risk brand‑impersonation site targeting Trezor users. The fully qualified domain trezo-start-io.framer.ai resolves to the Amazon Web Services address 31.43.161.6, which is registered to AS16509 Amazon.com, Inc. in the Netherlands. DNS resolution is served by four AWS nameservers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns). The domain was created on 6 January 2018 through CSC Corporate Domains, Inc. and is secured with a Let’s Encrypt certificate (issuer E8).

An HTTP request returns a 404 status code, and the page title reported by scanners reads “Trézor.io/start | Getting Started | TreZor® (official)”, indicating an attempt to mimic the official Trezor onboarding flow. Automated analysis detected the presence of Framer Sites, React, HSTS, and HTTP/3. The site has been flagged by 20 of 91 VirusTotal scanners and appears on three external blocklists; it is also listed by PhishDestroy, MetaMask, and SEAL as blocked. Gridinsoft assigned a trust score of 0 / 100, reinforcing the malicious assessment.

The current operational status is offline, and no live content was captured at the time of analysis, leaving the exact phishing payload unknown. Defenders should continue to block the domain and its associated IP, add the indicator set to internal threat feeds, and monitor for any re‑activation of the host. Given the use of a reputable SSL certificate and legitimate cloud infrastructure, future iterations could be quickly redeployed, so continuous DNS and certificate monitoring is advised. The combination of brand‑impersonation cues, low trust score, and multiple vendor detections justifies a high‑risk classification.