trzr-started[.]framer[.]ai

This domain is under investigation for brand impersonation targeting Trezor, a cryptocurrency hardware wallet provider. The threat type involves presenting a fraudulent interface mimicking Trezor’s official setup portal, likely intended to deceive users into exposing recovery seeds or installing malicious firmware. While the domain currently holds a risk level of under_investigation, the potential impact includes unauthorized access to cryptocurrency wallets and financial loss for victims. Analysis indicates the domain trzr-started.framer.ai was registered on January 06, 2018, through CSC Corporate Domains, Inc. It resolves to the IP address 52.223.52.2 and employs technologies including Framer Sites, React, HSTS, and HTTP/3. The SSL certificate is issued by Let’s Encrypt. Despite its age, the domain has only appeared on one security blocklist and is currently blocked by PhishDestroy. VirusTotal reports 0 detections out of 95 engines, suggesting evasion of automated detection mechanisms at the time of assessment. The page title, 'Trezor.io/Start®: Complete Trezor Suite Walkthrough,' directly mimics Trezor’s legitimate onboarding process, increasing the likelihood of successful social engineering. Mitigation steps for this specific threat type include immediate domain takedown requests to hosting providers and registrar-level suspension. Organizations should update blocklists to include this domain and its resolving IP address (52.223.52.2) in network security controls. Users who may have interacted with the domain should be advised to cease all engagement, revoke any connected wallet permissions, and initiate recovery seed regeneration on a secure device. Monitoring for similar domains using the 'trzr' prefix or 'framer.ai' subdomains is recommended to preempt further impersonation attempts.