info-trezor[.]framer[.]ai

Analysis of the domain info-trezor.framer.ai indicates it was actively impersonating Trezor, a cryptocurrency hardware wallet provider, as of its detection in July 2026. The domain was registered on January 6, 2018, through CSC Corporate Domains, Inc., and resolved to the IP address 31.43.161.6, located in the Netherlands under Amazon.com, Inc.'s AS16509. The page title, 'Trézor.io/Start | Getting Started & Secure Device Setup,' explicitly mimics Trezor's official onboarding process, aligning with the identified scam type of brand impersonation. Infrastructure analysis reveals the domain was hosted on Framer Sites and utilized technologies including React, HSTS, and HTTP/3. Nameservers were provided by Amazon Web Services (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns).

The SSL certificate was issued by Let's Encrypt, a common choice for both legitimate and malicious sites. At the time of assessment, the domain returned an HTTP 404 status, suggesting it had been taken offline or disabled. Detection data confirms the domain was flagged by three security blocklists: PhishDestroy, MetaMask, and SEAL. Gridinsoft assigned a trust score of 0/100, further indicating malicious activity. VirusTotal reported that 2 out of 91 security vendors classified the domain as malicious, though the absence of broader consensus does not diminish the confirmed blocklist entries.

Defenders should treat this domain as a confirmed brand impersonation threat targeting Trezor users. The use of a well-established registrar, legitimate hosting infrastructure, and valid SSL certificate underscores the sophistication of the campaign. Organizations are advised to block the domain at the DNS or proxy level, monitor for related domains leveraging similar naming conventions (e.g., 'trezor' in subdomains), and alert users to the risk of cryptocurrency wallet impersonation scams.