learn-trezor-eng[.]framer[.]ai

The domain learn-trezor-eng.framer.ai impersonates Trezor to conduct credential phishing attacks. Despite being offline now, it was previously detected by 2 out of 91 vendors on VirusTotal. The domain was also listed on public blocklists by PhishDestroy, MetaMask, and SEAL, indicating its malicious intent.

This phishing site mimicked Trezor's branding to deceive users into entering their login credentials. The page title 'Trezor® Wallet Login | Getting started — Trezor™' was crafted to appear legitimate and lure unsuspecting victims. Hosted on an IP address registered to Amazon.com, Inc. in the Netherlands, the domain utilized a Let's Encrypt SSL certificate, a common tactic to lend a false sense of security.

Registered through CSC Corporate Domains, Inc., learn-trezor-eng.framer.ai was created in January 2018 but only detected by PhishDestroy in June 2026, highlighting a potential resurgence or reactivation of the domain. The platform risk score of 68/100 underscores the threat level it posed during its active period. Although the domain is currently offline, its previous activity serves as a reminder of the ongoing risks associated with credential phishing scams.