treziostart-cloud-faq[.]framer[.]ai

Analysis of the domain treziostart-cloud-faq.framer.ai indicates it is a brand impersonation scam targeting Trezor, a cryptocurrency hardware wallet provider. The domain was registered on January 6, 2018, and is hosted on IP 31.43.161.6, part of Amazon.com, Inc. (AS16509) in the Netherlands. It is currently offline, returning an HTTP 404 status, but was previously flagged by three security blocklists: PhishDestroy, MetaMask, and SEAL. The page title, 'Trézor.io/Start® | Getting Started | TreZor® (Official)', explicitly mimics Trezor’s official onboarding portal, confirming the impersonation intent.

The domain was registered through CSC Corporate Domains, Inc., and uses AWS nameservers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns). SSL is provided by Let’s Encrypt (serial E8), and detected technologies include Framer Sites, React, HSTS, and HTTP/3. Gridinsoft assigned a trust score of 0/100. Two of 91 security vendors on VirusTotal flagged the domain at the time of scanning.

Defenders should treat this domain as high-risk due to its confirmed presence on multiple blocklists, explicit brand impersonation, and use of a hosting provider commonly exploited for phishing. While the domain is currently offline, historical DNS records should be reviewed for past resolutions, and any residual DNS cache or proxy references should be purged. Monitoring for re-activation or similar domains using the same infrastructure (e.g., Framer Sites, AWS nameservers) is recommended. No evidence of active malicious content is present at this time, but the domain’s prior classification as a scam warrants continued caution.