trezr-suit-en[.]framer[.]ai

Analysis of trezr-suit-en.framer.ai shows a domain created on 06 January 2018 that is currently taken offline, returning HTTP 404. The site was hosted on Amazon Web Services (IP 35.71.142.77, AS16509, United States) and used a Let's Encrypt E8 certificate, indicating TLS with HSTS enabled and support for HTTP/3. Detected front‑end technologies include Framer Sites and React, consistent with a modern web‑app presentation. The page title, "Official Trézor Suite — Desktop & Web App for Hardware Wallets," suggests an attempt to masquerade as a legitimate wallet application, while the listed brand target is Sui, confirming a brand‑impersonation motive.

The domain is registered through CSC Corporate Domains, Inc., and its authoritative nameservers are AWS‑managed (ns‑114.awsdns‑14.com, ns‑1198.awsdns‑21.org, ns‑1902.awsdns‑45.co.uk, ns‑635.awsdns). Security‑focused monitoring indicates the domain appears on a single blocklist and is specifically flagged by PhishDestroy, reinforcing the suspicion of malicious intent. VirusTotal reports show the domain was scanned by 95 security vendors, none of which raised a detection at the time of scanning; however, the absence of detections does not constitute a safety guarantee. The combination of brand‑impersonation language, a deceptive page title, and the presence on a phishing blocklist suggests the domain was used to lure victims into believing it was an official Sui‑related service.

Defenders should continue to block the domain at network perimeter devices, monitor for any resurgence of the site, and update URL filtering rules to include this host. Because the site is offline, immediate user exposure is limited, but the infrastructure—AWS hosting and a publicly trusted TLS certificate—could be reused for future impersonation campaigns. Ongoing vigilance is recommended, especially for users of Sui or hardware‑wallet applications, to prevent credential harvesting or malware distribution linked to this impersonation vector.