execuite-trazor[.]framer[.]ai

execuite-trazor.framer.ai is a phishing domain that impersonates the cryptocurrency hardware wallet brand Trezor. The domain is designed to trick users into believing they are on a legitimate Trezor setup page, with a page title reading 'Trezor Device Setup – Secure Your Crypto with Trezor Suite.' This is a brand impersonation scam targeting cryptocurrency users, and the domain has been taken offline. The domain is not safe and should be considered a scam.

Technical indicators for execuite-trazor.framer.ai include a VirusTotal detection rate of 0 of 95 vendors, meaning it was not flagged by security vendors at the time of analysis. It is registered through CSC Corporate Domains, Inc., and was created on January 06, 2018. The domain resolves to IP address 52.223.52.2, which is located in the US and hosted on AS16509 Amazon.com, Inc. It appears on 1 security blocklist, specifically PhishDestroy. The SSL certificate is issued by Let's Encrypt / E8. The domain uses technologies including Framer Sites, React, HSTS, and HTTP/3, and it currently returns an HTTP 404 status.

If a user interacted with execuite-trazor.framer.ai and provided credentials or connected a cryptocurrency wallet, immediate actions are required. For a crypto drainer scenario, revoke any token approvals granted to the site and move all funds to a new, secure wallet. For credential phishing, change passwords for any accounts entered on the site and enable two-factor authentication. Monitor accounts for unauthorized activity. Report the domain to authorities such as the FTC or local cybercrime units, and to Trezor's security team to help prevent further attacks.