trust-wallet-ex[.]framer[.]ai

This domain is flagged as an elevated-risk credential harvesting site specifically targeting Trust Wallet users through brand impersonation. Analysis indicates the threat actor designed the page to mimic a legitimate password change interface for the Trust Wallet browser extension, as evidenced by the page title 'Change Trust Wallet Extension Password.' The objective appears to be the collection of wallet credentials, which could lead to unauthorized access and asset theft from victims' cryptocurrency wallets. Infrastructure analysis reveals the domain trust-wallet-ex.framer.ai was registered through CSC Corporate Domains, Inc. and resolves to the IP address 31.43.160.6. At the time of assessment, the domain was detected by 8 out of 95 security vendors on VirusTotal and appears on three distinct security blocklists. Additional technical indicators include a Gridinsoft trust score of 0/100, a Let's Encrypt SSL certificate, and the use of Framer Sites, React, HSTS, and HTTP/3 technologies. The domain has since been taken offline, though its prior activity remains a documented risk. Mitigation for this type of credential harvesting attack involves immediate user education and infrastructure-level protections. Users who may have interacted with the domain should revoke any active sessions, reset credentials for associated accounts, and monitor for unauthorized transactions. Wallet providers are advised to implement real-time domain reputation checks and block known malicious domains at the network level. Organizations should also consider enhancing detection capabilities for domains registered through high-risk registrars or utilizing hosting infrastructure associated with prior phishing campaigns. Proactive monitoring for similar impersonation patterns, such as fake password reset pages, is recommended to prevent future incidents.