trrezrsuite[.]framer[.]ai

Analysis of trrezrsuite.framer.ai shows a clear case of brand impersonation targeting the Trezor hardware‑wallet ecosystem. The domain was registered on January 06, 2018 through CSC Corporate Domains, Inc. and is hosted on Amazon Web Services (ASN 16509) in the United States, resolving to IP 35.71.142.77. DNS resolution returns four Amazon Route 53 name servers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns). An SSL certificate issued by Let’s Encrypt (certificate identifier E8) is present, and the site advertises HSTS and HTTP/3 support, indicating modern web stack usage. The page title returned by the server is “Trezor Suite | Official App for Trezor Hardware Wallets,” matching the brand target and confirming the impersonation intent.

HTTP response code is 404, and the domain has been taken offline, with the current status listed as offline. The domain appears on a single security blocklist and has been blocked by the PhishDestroy service. VirusTotal reports that 95 scanning engines have examined the host, with no detections recorded; however, the lack of detections does not constitute evidence of safety. The site’s technology fingerprint shows Framer Sites and React, consistent with a quickly assembled phishing landing page.

The classification “Crypto Scam” aligns with the Trezor brand focus. While the page content has not been publicly examined, the combination of brand‑specific title, SSL configuration, and hosting on a reputable cloud provider suggests a deliberate attempt to lure cryptocurrency users. Defenders should continue to monitor the domain’s DNS and IP reputation, enforce blocklist entries for the host, and advise users to verify official Trezor URLs before entering credentials. Additional investigation of any archived snapshots could reveal the exact payload delivered before takedown.