trzor-io-start-us[.]framer[.]ai

The domain trzor-io-start-us.framer.ai is a noteworthy phishing threat, flagged by 5 out of 91 vendors on VirusTotal. Despite being taken down, it previously posed a significant risk, leveraging its Amazon hosting infrastructure to target unsuspecting users. The domain was added to public blocklists by PhishDestroy, MetaMask, and SEAL, indicating its malicious intent.

Registered through CSC Corporate Domains, Inc., this domain was first created in January 2018, but PhishDestroy identified its phishing activities in June 2026. This highlights the potential for dormant domains to be activated for malicious purposes years after their initial registration. The domain's platform risk score of 75 out of 100 underscores its potential threat level during its active period.

Though currently offline, trzor-io-start-us.framer.ai's association with Amazon's AS16509 network in the Netherlands suggests a sophisticated setup, possibly to exploit the trust associated with reputable hosting services. The domain's inclusion in multiple blocklists further emphasizes the need for continuous monitoring and swift action against such threats. The case of trzor-io-start-us.framer.ai serves as a reminder of the evolving tactics in the phishing landscape and the importance of proactive threat detection.