site-bridges[.]framer[.]ai

site-bridges.framer.ai was created on 04 April 2023 and is registered through CSC Corporate Domains, Inc. The domain resolves to the Amazon-owned address 35.157.26.135 in Germany (AS16509). Its four authoritative name servers – ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk and ns-635.awsdns – are typical of AWS Route 53 deployments. An SSL certificate issued by Let’s Encrypt (E8) is present, and the site advertised HSTS and HTTP/3 support, indicating a modern web stack built on Framer Sites and React. The page title returned by the server is "Connect & Unlock", and the domain is explicitly linked to a wallet/seed phishing campaign that impersonates the Trezor hardware-wallet brand.

Threat-intel sources place the domain on a single security blocklist and record it as blocked by PhishDestroy. VirusTotal scans show 11 of 93 antivirus engines flagging the host, reinforcing the malicious classification. Gridinsoft assigned a trust score of 0/100, and the HTTP response is a 404, suggesting the malicious page has been taken offline at the time of analysis. Despite the current offline status, the infrastructure—AWS hosting, Let’s Encrypt certificate, and the same naming pattern—remains reusable for future impersonation attempts.

Uncertainty remains regarding the exact content that was served before takedown; no visual or form details are available beyond the title. Defenders should continue to block the domain and its IP address at network perimeter and DNS filters, monitor for newly registered subdomains under the same registrar or similar naming conventions, and ensure that brand-specific safe-browsing lists include this host. Ongoing vigilance is required because the underlying AWS infrastructure can be rapidly repurposed for additional Trezor-related phishing campaigns.