suites-en[.]framer[.]ai

Analysis conducted on July 23, 2026 identifies the domain suites-en.framer.ai as an active component of a brand‑impersonation campaign targeting the cryptocurrency hardware‑wallet provider Trezor. The site resolves to the Amazon Web Services address 35.71.142.77, which is registered to AS16509 (Amazon.com, Inc.) in the United States. DNS records show four authoritative name servers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns) and the domain was created on 6 January 2018 through CSC Corporate Domains, Inc. The TLS certificate is issued by Let’s Encrypt (identifier E8) and includes HTTP Strict Transport Security, while the web stack reports Framer Sites, React, and HTTP/3 support. An HTTP request returns a 404 status, and the only published page title is “Official Guide: Install, Setup & Use Trezor Suite,” explicitly referencing the Trezor brand.

VirusTotal scans have recorded detections by seven of ninety‑five security vendors, and the domain appears on four independent phishing blocklists. Additionally, the domain is listed as blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura. The combination of brand‑specific page title, crypto‑scam classification, and hosting on a reputable cloud provider suggests a deliberate attempt to lure Trezor users to a malicious guide or credential‑harvesting page, although the exact payload cannot be confirmed because the server presently returns a 404 response.

Defenders should add the domain and its resolving IP address to network‑level deny lists, monitor for further activity from the same AWS subnet, and enforce strict outbound filtering for any connections to framer.ai subdomains that reference cryptocurrency hardware wallets. Continuous re‑scanning of the domain with sandbox and URL‑reputation services is advised to capture any future content changes.