help-trejorstart[.]framer[.]ai

The domain help-trejorstart.framer.ai is currently listed as offline, returning an HTTP 404 status code. The site presents a TLS certificate issued by Let’s Encrypt with an E8 signature, indicating a valid, albeit generic, encryption layer. DNS resolution points to the IP address 31.43.161.6, which is hosted in the Netherlands under ASN 16509, owned by Amazon.com, Inc. The registrar record shows the domain was created on January 06, 2018 and is managed through CSC Corporate Domains, Inc. Nameserver delegation includes ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns, confirming reliance on AWS DNS infrastructure. The page title retrieved from the domain is “Trezor.io/Start® — Starting Up Your Device | Trezor®,” directly referencing the Trezor brand and indicating a brand‑impersonation campaign. Technical fingerprints reveal the use of Framer Sites, React, HSTS, and HTTP/3, which are typical of modern web applications but also facilitate rapid deployment of malicious clones.

Security intelligence shows the domain is flagged by 13 of 91 VirusTotal scanners, and it appears on three external blocklists. It is actively blocked by PhishDestroy, MetaMask, and SEAL, and receives a Gridinsoft trust score of 0 out of 100, reflecting a high confidence of malicious intent. The threat classification is explicitly identified as brand impersonation targeting Trezor users. No additional content analysis is available beyond the page title, so the precise malicious payload or credential‑harvesting mechanism remains undefined.

Defenders should immediately add help-trejorstart.framer.ai to URL filtering, firewall, and DNS blocklists to prevent user access. Continuous monitoring of the associated IP range (31.43.161.0/24) is advised, as the hosting provider may be leveraged for related campaigns.