start-trezr-com[.]framer[.]ai

Analysis of start-trezr-com.framer.ai, observed on 24 July 2026, shows a domain that has been taken offline but retains several technical indicators consistent with a malicious phishing infrastructure. The domain was originally registered on 06 January 2018 through CSC Corporate Domains, Inc., and is hosted on an Amazon Web Services address (AS16509) located in the Netherlands (IP 31.43.161.6). DNS resolution uses four AWS nameservers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns). The site served a TLS certificate from Let’s Encrypt (certificate identifier “E8”), and HTTP headers reveal the use of HSTS and HTTP/3, confirming modern security configurations despite the malicious intent. Content analysis records the page title exactly as "start-trezr-com.framer.ai" and the HTTP response code returned 404, indicating the page no longer presents a valid payload but may have previously hosted a phishing landing page.

Security telemetry demonstrates that the domain is listed on three distinct blocklists and has been actively blocked by PhishDestroy, MetaMask, and the SEAL filtering system. VirusTotal scans show nine out of ninety‑one antivirus engines flagged the domain, reinforcing the suspicion of malicious activity. Independent assessment by Gridinsoft assigns a trust score of 0 out of 100, effectively classifying the site as completely untrusted. Technology fingerprinting identifies the underlying framework as Framer Sites built on React, a stack commonly abused for rapid deployment of fraudulent front‑ends.

While the exact target brand or credential‑stealing payload cannot be confirmed from the available intelligence, the combination of a compromised domain, low trust score, multiple vendor detections, and blocklist presence suggests a high probability of credential‑phishing use.