trzo-suite-apps[.]framer[.]ai

This domain trzo-suite-apps.framer.ai is identified as brand_impersonation infrastructure targeting users of the Trezor ecosystem through deceptive page presentation. The site is designed to replicate a legitimate crypto interface, as indicated by the page title "Trezor Suite® – Secure Crypto Interface℗", with the objective of harvesting sensitive wallet credentials or recovery phrases. The impersonation of a well-known hardware wallet brand significantly increases the likelihood of user trust exploitation and credential theft.

Technical evidence confirms malicious classification across multiple sources. VirusTotal reports 14/95 security vendors flagging the domain. It was registered through CSC Corporate Domains, Inc. on June 15, 2026, and appears on 3 security blocklists. The infrastructure resolves to IP 31.43.160.6 and uses a Let's Encrypt SSL certificate, a combination frequently observed in rapidly deployed impersonation campaigns.

Users who interacted with this domain should treat all entered seed phrases, passwords, or wallet data as compromised. Immediate mitigation includes transferring digital assets to a newly generated wallet, revoking any connected session permissions, and reviewing transaction history for unauthorized activity. Additionally, affected users should clear browser-stored credentials, reset related passwords, and monitor for follow-on phishing attempts leveraging stolen data.