online-treezr-suit[.]framer[.]ai

This domain, online-treezr-suit.framer.ai, is identified as a high-risk brand impersonation phishing site targeting users of the Sui blockchain ecosystem. Analysis confirms the domain mimics the official Trézor Suite interface, presenting itself as the "Official Trézor Suite — Desktop & Web App for Hardware" to deceive victims into entering sensitive credentials or private keys. The threat type aligns with credential harvesting and potential cryptocurrency wallet compromise, a common tactic in crypto-focused phishing campaigns. Infrastructure analysis reveals the domain was registered on January 6, 2018, through CSC Corporate Domains, Inc., though its malicious use appears more recent. It resolves to IP address 31.43.161.6 and employs a Let's Encrypt SSL certificate to appear legitimate. Security vendor detection on VirusTotal stands at 14/95, indicating moderate but consistent identification as malicious. The domain is listed on three security blocklists and has been proactively blocked by multiple browser-based security extensions and wallet protection tools. As of the latest assessment, online-treezr-suit.framer.ai has been taken offline, reducing immediate exposure risk. However, residual threats persist, including potential reuse of the domain or migration of the phishing infrastructure to alternative hosts. Users who interacted with the site are advised to revoke any active sessions, rotate credentials, and monitor wallet addresses for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.