us-trezor[.]framer[.]ai
“Official Site® | Trezor.io/start® - Trezor”
us-trezor.framer.ai — 内容不可用 (HTTP 404). 品牌冒充:Trezor; 诈骗类型:Brand Impersonation. 证据摘要: VirusTotal 3/91 (ChainPatrol, Kaspersky, LevelBlue); URLQuery 1 alert; URLScan malicious verdict; 2 external blocklist matches (MetaMask, SEAL); CF Radar malicious; PhishDestroy score 66/100. 注册商: CSC.
为保留原始取证记录,下方的 PhishDestroy AI 详细分析仍使用英文。
The domain us-trezor.framer.ai is flagged as a brand-impersonation site targeting the cryptocurrency hardware-wallet provider Trezor. The page title returned by the server is “Official Site® | Trezor.io/start® - Trezor”, which directly references the legitimate brand. An HTTP request yields a 404 status, indicating that the content is no longer publicly reachable, and the domain has been taken offline. Infrastructure analysis shows the domain resolves to 31.43.161.6, an address owned by Amazon Web Services (ASN 16509) located in the Netherlands. The SSL certificate is issued by Let’s Encrypt and carries the identifier “E8”, confirming the use of a free, automated certificate.
DNS is served by four AWS name servers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns). The site was registered on 6 January 2018 through CSC Corporate Domains, Inc., and the registrar information has not changed since creation. Security-vendor scans on VirusTotal report that three of ninety-one AV engines flagged the domain, and three independent blocklists have already listed it. It is also blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the consensus that the domain is malicious. The hosting stack includes Framer Sites, React, HTTP/3, and HSTS, which are typical of modern web applications but do not mitigate the impersonation risk.
Gridinsoft assigns a trust score of 0 / 100, reflecting a highly untrusted reputation. Uncertainty remains regarding the exact payload or credential-harvesting mechanisms, because the site is currently offline and no page capture is available. Defenders should continue to block the domain at perimeter and DNS filters, monitor the associated IP address for any re-use, and add the certificate fingerprint to TLS inspection rules.
网络安全情报
| Detection System | Indicator | Verdict | Alert |
|---|---|---|---|
| Quad9 DNS | us-trezor.framer.ai |
malicious | Sinkholed |
威胁响应 Pipeline
公共封禁名单状态
所用技术 · 4 identified
Framer is a no-code web design platform for designing and publishing responsive websites.
www.framer.com 置信度 100%React is an open-source JavaScript library for building user interfaces or UI components.
reactjs.org 置信度 100%HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.
www.rfc-editor.org 置信度 100%HTTP/3 is the third major version of the Hypertext Transfer Protocol used to exchange information on the World Wide Web.
httpwg.org 置信度 100%VirusTotal 分析
证据与外部报告
PD-20260621-95D544 Recipient: abuse@framer.com 您是否受到本网站的影响?
如果您输入了帐户凭据、个人或付款信息,或者从此域下载了文件,请立即采取措施。以下资源可帮助您报告事件并保护自己。