learn-trezr-io[.]framer[.]ai

Analysis of learn-trezr-io.framer.ai, observed on July 23, 2026, identifies the domain as a high‑risk brand‑impersonation campaign targeting Trezor users. The domain resolves to the IPv4 address 31.43.161.6, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the Netherlands. Registration information shows the domain was created on 6 January 2018 and is registered through CSC Corporate Domains, Inc., a registrar commonly used for legitimate and malicious actors alike. The TLS certificate is issued by Let’s Encrypt (identifier E8) and covers the subdomain, indicating the presence of encrypted transport but providing no assurance of legitimacy.

Infrastructure analysis reveals the domain is served by the Framer Sites platform, as indicated by detected technologies: Framer Sites, React, HSTS, and HTTP/3. The authoritative nameservers are ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns, all hosted on Amazon Route 53, further confirming the use of Amazon‑owned DNS infrastructure. The HTTP response for the root URL returns a 404 status, suggesting that the malicious page may be hosted under a different path or that the site was taken down prior to analysis.

Reputation signals are strongly negative. The domain appears on three independent security blocklists, specifically PhishDestroy, MetaMask, and SEAL, and is flagged by Gridinsoft with a trust score of 0 out of 100. VirusTotal analysis shows that 11 of 91 scanned security vendors flagged the domain as malicious, providing additional corroboration of its malicious intent. The page title observed during probing, “Trezor.io/Start® — Starting Up Your Device | Trezor®”, directly copies the official Trezor branding, reinforcing the classification as brand impersonation.

Given the available evidence, defenders can reasonably conclude that learn‑trezr‑io.framer.ai is being used to deceive Trezor users, likely to harvest credentials or install malware.