home-tzersuite[.]framer[.]ai

The domain home-tzersuite.framer.ai is currently offline and returns an HTTP 404 status code, indicating the web resource is unavailable. VirusTotal records show that 7 of 95 security vendors have flagged the domain, suggesting a moderate level of detection across the security community. The domain resolves to the IP address 35.71.142.77, which belongs to Amazon Web Services (AS16509) and is geolocated in the United States. Registration details list CSC Corporate Domains, Inc. as the registrar, and the domain was created on January 06, 2018.

The page title associated with the domain is "Official Trézor Suite — Desktop & Web App for Hardware Wallets," and the domain is explicitly identified as impersonating the Sui brand. Infrastructure analysis reveals four authoritative nameservers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns) and the presence of modern web technologies such as Framer Sites, React, HSTS, and HTTP/3. The SSL certificate is issued by Let’s Encrypt (E8). The domain appears on four security blocklists and is blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura, reinforcing its classification as a brand‑impersonation threat.

While the 404 response prevents direct observation of malicious payloads or credential‑phishing pages, the combination of vendor detections, blocklist listings, and the explicit brand‑impersonation label provide sufficient evidence for defensive action. Security teams should add the domain and its resolving IP to deny lists, monitor related AWS IP ranges for similar activity, and treat any future resolution of the domain as malicious. Continuous re‑evaluation is advised in case the site becomes active again, at which point content analysis would be required to confirm the exact phishing or credential‑harvesting mechanisms employed.