trezur-en-us[.]framer[.]ai

trezur-en-us.framer.ai was first registered on 2018-01-06 through CSC Corporate Domains, Inc. The domain resolves to 31.43.160.6, an Amazon.com, Inc. address located in the Netherlands (AS16509). DNS is served by four AWS name servers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns). The site presented a page titled “Trézor Login | Trézor Hardware Wallet (Official)” and was identified as a credential‑phishing campaign targeting users of the Trézor hardware wallet. Technical analysis shows the site was built on Framer Sites and React, with HSTS and HTTP/3 enabled, and used a Let’s Encrypt certificate (E8).

An HTTP request returned a 404 status before the site was taken offline. Reputation scoring is extremely low: Gridinsoft assigned a trust score of 0/100, and three independent blocklists (PhishDestroy, MetaMask, SEAL) have listed the domain. VirusTotal recorded 2 detections out of 91 security scanners, confirming malicious classification. The combination of a brand‑specific page title, low trust score, and multiple blocklist entries indicates deliberate credential harvesting.

At present the infrastructure is offline, but the hosting footprint (AWS) suggests the operators could redeploy similar clones rapidly. Defenders should continue to block the domain at network perimeter, monitor for DNS queries to the listed AWS name servers, and add the IP address 31.43.160.6 to threat‑intel feeds. Users of Trézor hardware wallets should be warned not to enter credentials on any site hosted under the framer.ai sub‑domain and should verify URLs against official sources. Ongoing surveillance is advised to detect any re‑appearance of the domain or related infrastructure.