static-site-682503[.]framer[.]app

This domain, static-site-682503.framer.app, is actively impersonating Trezor, a hardware cryptocurrency wallet provider, to deceive users into disclosing sensitive credentials or installing malicious software. The page mimics the official Trezor onboarding process, displaying the title "Trézor.io/start | Getting Started with TreZor®" to exploit typographical variations of the legitimate domain. Such impersonation tactics are commonly associated with crypto drainer schemes, where attackers trick victims into connecting wallets to malicious smart contracts, resulting in unauthorized fund transfers. The use of a subdomain under Framer’s infrastructure further obscures the malicious intent, leveraging a legitimate service to bypass initial scrutiny. Analysis indicates the domain is flagged by 2 out of 95 security vendors on VirusTotal, a relatively low detection rate that suggests either recent deployment or evasion techniques. The domain resolves to the IP address 31.43.160.6 and is hosted on Framer’s platform, a service often abused for rapid deployment of phishing pages. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites due to its free and automated issuance process. No historical registration data is publicly available, which aligns with the use of a subdomain service rather than a standalone domain. Blocklist monitoring services have not yet widely flagged this infrastructure, though the active status and targeted brand impersonation elevate the risk profile. Users who visited static-site-682503.framer.app should immediately revoke any wallet connections or credentials entered on the site. If cryptocurrency transactions were initiated, monitor wallet activity for unauthorized transfers and consider moving assets to a new wallet. Clear browser cache and cookies to remove any residual session data. Report the domain to security teams at Trezor and the hosting provider, Framer, to facilitate takedown efforts. Exercise caution with future interactions involving Trezor or similar services, verifying domain authenticity through official channels before entering sensitive information. Infrastructure analysis reveals the domain remains operational as of this report, underscoring the need for heightened vigilance.