trezrriostart[.]framer[.]ai

Analysis of trezrriostart.framer.ai shows a domain actively used for brand impersonation of the cryptocurrency hardware‑wallet provider Trezor. The site’s page title, "Official Site® | Trezor.io/start® | Getting Started," explicitly references the Trezor brand, confirming the intent to deceive users seeking legitimate onboarding resources. Technical profiling reveals the domain hosts a Framer‑based site built with React, enforces HSTS, and supports HTTP/3, indicating a modern web stack that could be leveraged to mimic authentic user experiences. The domain resolves to IP address 52.223.52.2, an Amazon Web Services host located in the United States under ASN 16509 (Amazon.com, Inc.). The SSL certificate is issued by Let’s Encrypt (certificate identifier E8), providing valid TLS encryption but offering no reputation assurance.

An HTTP request returns a 404 status, suggesting the malicious page has been taken offline at the time of analysis. VirusTotal records indicate that 15 of 95 scanned security vendors flagged the domain, reflecting a moderate detection consensus across commercial scanners. The domain appears on a single public blocklist and is listed as blocked by PhishDestroy, reinforcing its classification as a malicious resource. Registration data shows the domain was created on January 06, 2018 and was registered through CSC Corporate Domains, Inc., with four AWS name servers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns). The associated scam type is identified as a crypto scam, targeting users of Trezor’s hardware wallets.

While the site is currently offline, the infrastructure—AWS hosting, valid TLS, and a modern web framework—remains reusable for future impersonation campaigns. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists, and monitor the associated IP range for re‑use.