webpage-terzr-io-cdn[.]framer[.]ai

This domain hosts a fake Trezor device initialization page designed to deceive users into entering sensitive recovery phrases or private keys. The site mimics the official Trezor.io/Start interface, potentially leading to unauthorized access to cryptocurrency wallets if credentials are submitted. The threat primarily targets users attempting to set up or recover Trezor hardware wallets, exploiting trust in the brand to harvest confidential information. Analysis indicates the domain was registered on January 6, 2018, through CSC Corporate Domains, Inc., a registrar commonly used for both legitimate and malicious infrastructure. As of the latest scan, 2 out of 95 security vendors on VirusTotal flag the domain as malicious, with additional detections from three independent security blocklists. The SSL certificate is issued by Let's Encrypt, providing a false sense of security while the domain resolves to the IP address 31.43.161.6. The page title explicitly claims to be the "Official Start Page" for Trezor device initialization, a clear indicator of brand impersonation. If this domain was visited, immediate action is required. Do not enter any recovery phrases, private keys, or personal information. Disconnect the device from the internet and run a full security scan using updated antivirus software. If credentials were already submitted, transfer all cryptocurrency assets to a new wallet immediately and revoke any connected authorizations. Monitor accounts for unauthorized transactions and consider reporting the incident to relevant cybersecurity authorities or the impersonated brand’s official security team for further mitigation.