active-emojis-478041[.]framer[.]app

The domain active-emojis-478041.framer.app is suspected of brand impersonation, specifically targeting the cryptocurrency hardware wallet brand Trezor. The domain mimics the legitimate Trezor Suite interface, potentially misleading users into believing they are interacting with official Trezor services.

Technical analysis reveals that the domain has been flagged by 3 out of 95 security vendors on VirusTotal. The domain is registered through Framer, a platform typically used for prototyping and designing user interfaces. It resolves to the IP address 31.43.161.6 and was created recently. The SSL certificate is issued by Let's Encrypt, which is a common practice for both legitimate and malicious sites to gain user trust. The domain does not appear on the Google Safe Browsing list, and there are no known drainer kits associated with this domain.

The domain remains active, posing a high risk of brand impersonation. Immediate response actions include reporting the domain to Framer for potential takedown, alerting Trezor's security team, and updating user advisories to warn about this impersonation. Despite these actions, the risk remains significant as the domain continues to operate and could potentially compromise users' sensitive information. Further monitoring and proactive measures are recommended to mitigate this threat.