trezorlive[.]framer[.]ai

The domain trezorlive.framer.ai, now offline, impersonates Trezor, a well-known cryptocurrency hardware wallet provider. It has been flagged by six out of 95 vendors on VirusTotal, indicating a significant level of detection among security services. The domain is also listed on three public blocklists, including PhishDestroy, MetaMask, and SEAL.

This phishing operation uses the page title 'Official Tr0rezor Suite e28094 Desktop & Web App for Hardware' to deceive users into believing they are accessing a legitimate Trezor service. The domain was registered through CSC Corporate Domains, Inc., and hosted on an Amazon server in the Netherlands, with an IP address of 31.43.160.6. The SSL certificate was issued by Let's Encrypt, a common choice for both legitimate and malicious sites.

Despite its offline status, the domain's previous activity highlights the ongoing threat of phishing campaigns targeting cryptocurrency users. The platform risk score of 75/100 underscores the potential danger it posed before being taken down. The early detection by PhishDestroy on June 21, 2026, showcases the effectiveness of proactive monitoring in identifying threats before they can cause widespread harm. As phishing tactics continue to evolve, staying informed about such threats is crucial for maintaining cybersecurity.