started-trezrio[.]framer[.]ai

The domain started-trezrio.framer.ai is currently offline but was previously reachable at the IPv4 address 31.43.161.6, which is hosted in the Netherlands under ASN16509 belonging to Amazon.com, Inc. The domain was registered on January 06, 2018 through CSC Corporate Domains, Inc. and is served by four AWS name servers: ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns. Infrastructure analysis shows the site employed Framer Sites and React frameworks, enforced HSTS, and supported HTTP/3, indicating a modern web stack. The SSL certificate was issued by Let’s Encrypt (E8), confirming the use of a free, automated certificate authority. The page title retrieved during the last scan read "Trézor.io/start | Getting Started with TreZor®," directly referencing the Trezor brand and confirming a brand impersonation intent.

Security telemetry lists the domain on three public blocklists and records that it is blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its malicious classification. The Gridinsoft trust score of 0 out of 100 further reflects a high confidence of abuse. VirusTotal analysis recorded 12 detections out of 91 scanning engines, providing independent confirmation of malicious activity.

While the current HTTP response is a 404 error, the historical evidence of brand impersonation, the presence on multiple blocklists, and the low trust score indicate that the domain should be considered hostile. Defenders should continue to block the domain at perimeter and DNS layers, monitor the associated IP address for any reactivation, and include the domain in threat intelligence feeds. Ongoing observation is advised in case the site becomes active again or spawns additional malicious infrastructure.