learn-trzor[.]framer[.]ai

Analysis of learn-trzor.framer.ai indicates a high-risk brand impersonation domain targeting Trezor, a cryptocurrency hardware wallet provider. The domain was registered on January 6, 2018, through CSC Corporate Domains, Inc., and currently resolves to 31.43.160.6, hosted on Amazon Web Services (AS16509) in the Netherlands. Despite its age, the domain exhibits characteristics consistent with phishing infrastructure: the page title 'Trezor.io/start: Secure Your First Bitcoin Today' directly mimics Trezor’s official onboarding process, suggesting an intent to deceive users into entering sensitive wallet credentials or recovery phrases. As of July 24, 2026, the domain returns an HTTP 404 status, indicating it is offline, though this does not preclude reactivation. Ten of 91 security vendors on VirusTotal flagged the domain as malicious, and it appears on three blocklists, including PhishDestroy, MetaMask, and SEAL.

Gridinsoft assigns a trust score of 0/100, reinforcing its classification as high-risk. The site was built using Framer Sites and React, with HTTP/3 and HSTS enabled, which may be leveraged to lend an appearance of legitimacy. SSL certification is provided by Let’s Encrypt (serial E8), a common choice for both legitimate and malicious sites. Infrastructure analysis reveals AWS nameservers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns), typical of cloud-hosted phishing campaigns.

The combination of brand impersonation, detection by security vendors, and blocklist inclusion confirms the domain’s role in fraudulent activity. Defenders should treat this domain as compromised and maintain blocking rules even while offline. No evidence suggests the site was used for crypto draining or other specific scam subtypes beyond brand impersonation. Further investigation into historical content or redirects may clarify its exact operational tactics, but current indicators warrant immediate mitigation.