ioplatform-trezor[.]framer[.]ai

Analysis of the domain ioplatform-trezor.framer.ai indicates it is a brand impersonation scam targeting Trezor, a hardware wallet provider. The domain was registered on January 6, 2018, through CSC Corporate Domains, Inc., and was taken offline by the report date of July 24, 2026. Infrastructure analysis reveals it resolved to the IP address 31.43.161.6, hosted in the Netherlands under AS16509 (Amazon.com, Inc.). The domain's SSL certificate was issued by Let's Encrypt, and it returned an HTTP 404 status at the time of assessment, suggesting it is no longer actively serving content.

The page title, 'Official Trezor™ Suite — Desktop & Web App for Hardware Wallets,' explicitly impersonates Trezor’s official software, aligning with the scam type labeled as brand impersonation. Detection data shows limited but actionable evidence: one security vendor flagged the domain on VirusTotal, and it appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. Gridinsoft assigned a trust score of 0/100, reinforcing its classification as malicious. Nameservers for the domain are hosted on AWS (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns), a common infrastructure choice for both legitimate and malicious domains.

While the domain is currently offline, defenders should treat it as a confirmed threat based on its historical activity, blocklist presence, and impersonation of a cryptocurrency hardware wallet brand. Organizations are advised to block the domain at the DNS level and monitor for any reactivation or associated indicators, such as the IP address or SSL certificate thumbprint. Further investigation into related domains or infrastructure may uncover additional threats linked to this campaign.