suite-en[.]framer[.]ai

On July 25, 2026, the domain suite-en.framer.ai was observed offline and is currently listed by PhishDestroy as a malicious site that impersonates the cryptocurrency hardware‑wallet brand Trezor. The site’s page title, “Connect & Find Your Trezor,” directly references the target brand, confirming a brand‑impersonation tactic. Registry data shows the domain was registered on 6 January 2018 through CSC Corporate Domains, Inc. The hosting resolves to the IP address 64.29.17.195, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. DNS resolution uses four Amazon Route 53 nameservers: ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns. The TLS certificate is issued by Let’s Encrypt (E8), and the site advertised HSTS and HTTP/3 support.

A technology fingerprint identified Framer Sites and React, consistent with a modern front‑end stack. When queried, the HTTP response returned a 404 status code, indicating the content is not being served at the time of check. VirusTotal analysis returned 10 detections out of 95 scanners, and the domain appears on a single external blocklist, reinforcing its malicious classification. The threat is categorized as a “Crypto Scam,” suggesting the actors may attempt to harvest credentials or lure victims into fraudulent crypto‑related transactions. The presence of a valid TLS certificate does not mitigate risk, as encrypted channels are routinely used by malicious actors to gain user trust.

Uncertainties remain regarding the current payload or credential‑capture mechanisms because the site is offline and no page content was captured. Defenders should continue to block the domain at network perimeters, update DNS filtering policies, and ensure that endpoint protection solutions incorporate the latest indicator set, including the domain name, its IP address, and the associated nameservers.