treasure--suit[.]framer[.]ai

Analysis of treasure--suit.framer.ai indicates that the domain is being used for a brand‑impersonation crypto scam targeting the Sui ecosystem. The domain resolves to the Amazon Web Services address 52.223.52.2 (AS16509, United States) and is served through Route 53 name servers ns‑114.awsdns‑14.com, ns‑1198.awsdns‑21.org, ns‑1902.awsdns‑45.co.uk and ns‑635.awsdns. The site presents a valid Let's Encrypt certificate (CN E8) and enforces HSTS and HTTP/3, which are typical of legitimate Framer‑hosted sites. An HTTP request returns a 404 status with the page title “Site Not Found | Framer”, consistent with the current offline state.

The domain was created on 06 January 2018 and is registered via CSC Corporate Domains, Inc. It appears on a single security blocklist and has been flagged by PhishDestroy. VirusTotal reports that the domain has been scanned by 95 vendors, but no detections are listed; this absence cannot be interpreted as a safety guarantee. The only concrete malicious indicator is the documented impersonation of the Sui brand and classification as a crypto‑scam. Evidence beyond the infrastructure and blocklist presence is presently limited, and the live content has not been captured.

Defenders should treat the domain as malicious, add it to DNS‑level deny lists, and monitor for additional subdomains under framer.ai that follow similar naming patterns. Because the hosting provider is AWS, rapid re‑deployment on new IPs is possible; continuous observation of AWS‑owned address space for related activity is recommended. Organizations using Sui‑related services should also consider user‑education campaigns to alert personnel to unsolicited links referencing this domain.