newcomer-wheel-891736[.]framer[.]app

This domain, newcomer-wheel-891736.framer.app, represents a confirmed brand impersonation threat specifically targeting users of a widely recognized cryptocurrency hardware wallet. The site presents itself as the official management application, using the page title 'Trezor Suite | Official Crypto Management App' to deceive visitors into entering sensitive credentials, recovery phrases, or private keys. Such impersonation attacks are designed to exfiltrate cryptographic secrets, enabling unauthorized access to digital assets stored in user wallets. The high-risk nature of this threat is amplified by its active status and the critical sensitivity of the targeted information. Analysis of the domain's infrastructure reveals several concerning indicators. The domain resolves to the IP address 31.43.160.6 and is hosted on a platform that provides subdomains under framer.app, a legitimate service often abused for phishing campaigns. According to aggregated threat intelligence, 5 out of 95 security vendors on VirusTotal have flagged this domain as malicious, indicating emerging but not yet widespread detection. The SSL certificate is issued by Let's Encrypt, a common provider for both legitimate and malicious sites, which does not mitigate the risk. No specific registrar or creation date is publicly available for this subdomain, but the hosting pattern aligns with known phishing tactics leveraging free or low-cost platforms to evade initial scrutiny. Users who have visited newcomer-wheel-891736.framer.app or interacted with its content are advised to take immediate corrective actions. First, cease all interaction with the domain and avoid entering any credentials or sensitive information. If any data was submitted, assume it has been compromised and initiate recovery protocols for the affected wallet, including generating new recovery phrases and transferring assets to a new, secure wallet. Monitor all associated accounts for unauthorized transactions and enable additional authentication measures where available. Report the domain to relevant security teams and blocklist providers to aid in broader mitigation efforts. Regularly update security tools to ensure detection of similar threats in the future.