treasurresuit[.]framer[.]ai

Analysis of treasurresuit.framer.ai, registered on April 04, 2023 through CSC Corporate Domains, Inc., shows infrastructure consistent with a brand‑impersonation campaign targeting the Sui cryptocurrency platform. The domain resolves to 52.223.52.2, an address owned by Amazon.com, Inc. (AS16509) and located in the United States. DNS configuration lists four Amazon Route 53 name servers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns). The site presents a Let's Encrypt certificate issued by the E8 authority, indicating a valid TLS certificate but offering no inherent trust.

HTTP requests return a 404 status with the page title “Site Not Found | Framer”, and the domain is currently taken offline. Despite the lack of active content, the domain has been flagged by PhishDestroy and appears on a single security blocklist, confirming that defensive services have identified it as malicious. VirusTotal reports that the domain was scanned by 93 vendors, none of which raised a detection at the time of analysis; this absence of alerts does not constitute a safety assurance. Automated technology fingerprinting identifies Framer Sites, React, HSTS and HTTP/3, a stack commonly used by fraudulent actors to host convincing replica pages.

The campaign is classified as a crypto scam, and the explicit impersonation of Sui suggests intent to lure victims into fraudulent transactions or credential harvesting. Because the site is offline, direct payload analysis is unavailable, and the exact malicious payload or phishing flow remains uncertain. Defenders should continue to block the domain at network perimeter, monitor DNS queries for the associated IP address and name servers, and consider adding the IP to threat‑intel feeds. Ongoing observation of the registrar and any future re‑activation of the domain is advised, as actors often recycle infrastructure after takedown.