second-cylinder-751877[.]framer[.]app

This domain is flagged as a high-risk brand impersonation phishing site specifically targeting Trezor hardware wallet users. Analysis indicates the page mimics the official Trezor login interface, presenting itself as the "Official Trezor Login - Desktop & Web App for Hardware Wallets" to deceive victims into entering credentials or seed phrases. The threat type aligns with crypto drainer pre-attack reconnaissance, where stolen credentials are later used to compromise wallet funds.

Infrastructure analysis reveals the domain second-cylinder-751877.framer.app is registered through Framer, a legitimate web development platform often abused for hosting phishing pages. The domain resolves to IP address 31.43.161.6 and maintains an active Let's Encrypt SSL certificate, creating a false sense of legitimacy. VirusTotal detection shows 2 out of 95 security vendors currently flag the domain, a low but non-zero detection rate that may indicate early-stage malicious activity or evasion techniques. No historical blocklist data or trust scores were provided, though the domain remains operational as of the latest verification.

Mitigation requires immediate action from both users and security teams. Users who accessed the site should assume credential compromise and initiate wallet recovery procedures using official Trezor channels, including seed phrase regeneration and fund migration to new addresses. Security teams should block the domain and IP at network perimeter controls, including firewalls, DNS filters, and email security gateways. Given the Framer-based infrastructure, monitoring for similar patterns (e.g., framer.app subdomains with random prefixes) is recommended. Incident responders should preserve all available artifacts, including page screenshots, network logs, and SSL certificate details, for potential takedown requests or law enforcement coordination.