dandy-bookings-026921[.]framer[.]app

Analysis of the domain dandy-bookings-026921.framer.app indicates it was actively impersonating Trezor, a cryptocurrency hardware wallet provider, as of July 23, 2026. The page title, 'Official Site® | Trezor.io/start® - Trezor,' directly mimics Trezor's official onboarding URL, suggesting an intent to deceive users into believing they were accessing legitimate Trezor resources. The domain was hosted on Framer's platform and resolved to the IP address 31.43.160.6, associated with Amazon.com, Inc. (AS16509) in the Netherlands. SSL certification was provided by Let's Encrypt (YE1), a common choice for both legitimate and malicious sites.

Infrastructure analysis reveals the domain was flagged by three security blocklists and detected by 8 of 91 security vendors on VirusTotal, indicating elevated risk. It was also blocked by PhishDestroy, MetaMask, and SEAL, further corroborating its malicious classification. The domain is currently offline, returning an HTTP 404 status, and its nameservers are unresolvable (NS_NOT_FOUND). Technologies detected include Framer Sites, React, HSTS, and HTTP/3, which are consistent with modern web development practices but do not inherently indicate malicious intent.

Defenders should treat this domain as part of a broader Trezor impersonation campaign. While the exact content of the phishing page remains unanalyzed, the combination of the page title, brand impersonation, and detection by multiple security vendors confirms its fraudulent nature. Organizations are advised to block the domain at the network level and monitor for related infrastructure, particularly domains hosted on Framer or resolving to the same IP range. Given the use of HSTS and HTTP/3, this campaign may have targeted users with modern browsers, emphasizing the need for up-to-date endpoint protection and user awareness training.