trezsuiteapp-enus[.]framer[.]ai

This domain, trezsuiteapp-enus.framer.ai, is actively engaged in credential harvesting operations targeting users of the Framer platform. The site presents a deceptive interface designed to mimic legitimate Framer authentication portals, tricking users into submitting login credentials, API keys, or other sensitive account information. Analysis of the page structure reveals input fields for email addresses and passwords, along with visual elements consistent with Framer’s branding, indicating a targeted impersonation campaign. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification. The domain resolves to IP address 31.43.160.6 and was registered on January 6, 2018, through CSC Corporate Domains, Inc. Despite its age, the domain has only been flagged by 2 out of 95 security vendors on VirusTotal, suggesting either recent activation for malicious purposes or effective evasion techniques. The SSL certificate is issued by Let’s Encrypt, providing HTTPS encryption to lend an appearance of legitimacy while failing to prevent credential interception. No entries were found on major blocklists at the time of analysis, further complicating detection efforts. Users who have visited trezsuiteapp-enus.framer.ai or entered credentials on the site should immediately revoke any exposed passwords and API keys. Reset credentials for all accounts where the same password may have been reused, particularly Framer and associated email accounts. Monitor linked accounts for unauthorized access attempts, and enable multi-factor authentication where available. Security teams should block the domain and IP address 31.43.160.6 at the network perimeter, and inspect logs for connections to either indicator. If credentials were submitted, assume full account compromise and conduct a forensic review of recent activity for signs of lateral movement or data exfiltration.