home-suites-eng[.]framer[.]ai

The domain home-suites-eng.framer.ai was observed hosting a page titled “Official Trezor Suite — Desktop & Web App for Hardware Wallets,” which directly references the Trezor brand. Registration information shows the domain was created on 04 April 2023 through CSC Corporate Domains, Inc., and the authoritative name servers are ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns. DNS resolution points to the Amazon Web Services address 35.71.142.77, located in the United States and announced by AS16509 (Amazon.com, Inc.). The site employed modern web stack components including Framer Sites, React, HTTP/3, and HSTS, and served a valid Let’s Encrypt certificate (issuer E8).

An HTTP request returned a 404 status code, and the domain has since been taken offline. Threat intelligence classifies the content as a crypto‑related scam that impersonates the Trezor hardware‑wallet service. The domain appears on a single blocklist, PhishDestroy, and one of ninety‑three VirusTotal scanners raised a detection, indicating at least minimal malicious reputation. Because the site is no longer reachable, active exploitation cannot be confirmed, but the combination of brand impersonation, a legitimate‑looking page title, and hosting on a reputable cloud provider suggests a potential credential‑harvesting or malware‑delivery campaign targeting cryptocurrency users.

Defenders should continue to block the domain at perimeter filters, monitor for any residual traffic to the IP address 35.71.142.77, and update endpoint detection rules to flag connections to Let’s Encrypt‑issued sites that reference Trezor‑related keywords. Incident response teams should also review recent logs for attempts to contact this domain, especially from users who manage Trezor wallets, and consider user education about unsolicited prompts for Trezor Suite access.