installed-trrzr-bridge-en[.]framer[.]ai

This domain, installed-trrzr-bridge-en.framer.ai, is actively impersonating Trezor, a well-known cryptocurrency hardware wallet provider. Analysis indicates the threat type as brand impersonation, specifically targeting users seeking the legitimate Trezor Bridge software. The page title, "Trezor Bridge – Seamless Integration Between Device and Computer," mimics official Trezor branding to deceive victims into downloading malicious software or entering sensitive credentials. No direct evidence of a crypto drainer kit was observed, but the infrastructure aligns with phishing campaigns designed to compromise cryptocurrency assets.

Infrastructure analysis reveals the following technical indicators: The domain resolves to IP address 31.43.161.6 and was registered on January 6, 2018, through CSC Corporate Domains, Inc. VirusTotal detection shows 3 out of 95 security vendors flagging the domain as malicious. The Gridinsoft trust score is 0/100, and the domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious domains. Google Safe Browsing (GSB) status was not explicitly provided, but the domain's presence on multiple blocklists suggests it is likely flagged.

As of the latest assessment, the domain remains active, posing a continued risk to users. Response actions by security providers have included blocking the domain via PhishDestroy, MetaMask, and SEAL, but no takedown has been observed. The remaining risk is classified as high due to the domain's persistence, brand impersonation tactics, and potential to distribute malware or harvest credentials. Users are advised to avoid interacting with the domain, verify software downloads exclusively from official sources, and employ browser-based security tools to block known malicious sites.