trustsextension[.]framer[.]media

This domain is flagged for brand impersonation targeting Trust Wallet users through a fraudulent password update interface. The page, titled 'Secure Your Trust Wallet Extension: Password Update,' mimics legitimate wallet security prompts to harvest sensitive credentials, including recovery phrases and private keys. Analysis indicates the domain was designed to exploit user trust in official wallet security procedures, increasing the likelihood of successful compromise. Infrastructure analysis reveals the domain resolves to IP 31.43.160.6 and was registered through Framer, a platform commonly used for rapid deployment of web content. Security vendors on VirusTotal flagged the domain at a rate of 4/95, while three independent security blocklists have listed it as malicious. The SSL certificate is issued by Let's Encrypt, a common tactic to lend superficial legitimacy to phishing sites. Technologies detected include Framer Sites, React, HSTS, and HTTP/3, suggesting a modern, responsive design intended to evade basic detection mechanisms. Users who visited trustsextension.framer.media should immediately revoke any permissions granted to browser extensions or applications linked to the domain. If credentials or recovery phrases were entered, affected wallets must be transferred to new, secure addresses, and all connected devices should be scanned for malware. Monitor transaction histories for unauthorized activity and report the incident to relevant security teams for further mitigation. The domain is currently offline, but similar threats may reappear under different infrastructure.