trzor-suiters[.]framer[.]ai

Analysis of the domain trzor-suiters.framer.ai indicates a crypto scam impersonating Trezor, a hardware wallet provider. The domain was registered on April 4, 2023, through CSC Corporate Domains, Inc., and resolves to IP 52.223.52.2, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The page title, 'Trezor Suite | Official App to Manage and Secure Your Crypto,' directly mimics Trezor's legitimate branding, aligning with the reported scam type targeting cryptocurrency users. The domain is currently offline, returning an HTTP 404 status, and appears on one security blocklist.

Six of 95 security vendors on VirusTotal flagged the domain as malicious, though the specific detection criteria remain unverified. SSL certification is provided by Let's Encrypt (E8), a common but not inherently suspicious issuer. Technologies detected include Framer Sites, React, HSTS, and HTTP/3, suggesting a modern web framework was used to construct the phishing page. Nameservers are hosted under AWS (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns), consistent with cloud-based hosting.

Defenders should treat this domain as a confirmed brand impersonation threat, particularly for users of Trezor products. While the domain is offline, monitoring for reactivation or related infrastructure (e.g., IP, nameservers) is recommended. No evidence of widespread distribution or additional attack vectors (e.g., malware, credential harvesting) is present in the available data.