bold-truly-484634[.]framer[.]app

The domain bold-truly-484634.framer.app was identified as a high‑risk Trezor brand impersonation campaign. Infrastructure analysis shows the domain resolves to IP address 31.43.161.6, which is geolocated to the Netherlands and belongs to Amazon.com, Inc. (AS16509). The site is protected by a Let’s Encrypt certificate (certificate identifier YE1) and serves content over HTTP/3 with HSTS enabled, indicating modern web stack usage. Technical fingerprints reveal the presence of Framer Sites and a React framework, consistent with the registrar information that the domain was registered through the Framer platform.

The HTTP response returned a 404 status code, and the DNS query for nameservers yielded NS_NOT_FOUND, suggesting the domain is no longer serving active content. The page title returned by the server matches the official Trezor start page: "Trezor.io/Start | Official Start Page — Initialize Your Device™," confirming deliberate brand impersonation. Detection metrics indicate that ten of ninety‑one VirusTotal scanners flagged the domain, and it appears on three external blocklists, including PhishDestroy, MetaMask, and SEAL.

The domain is currently listed as offline, yet its previous activity warrants continued monitoring. Defenders should ensure that the IP 31.43.161.6 is blocked at network perimeters, add the full domain to URL filtering rules, and watch for new subdomains or similarly structured Framer‑hosted sites targeting cryptocurrency hardware wallets. Ongoing threat‑intel feeds should be consulted for any resurgence of this infrastructure, and any observed attempts to resolve the domain or its IP should be logged as potential reconnaissance activity.