app-suitetrezr[.]framer[.]ai

This domain, app-suitetrezr.framer.ai, is currently offline but was flagged for brand impersonation targeting Trezor, a cryptocurrency hardware wallet provider. Analysis indicates the domain was created on January 6, 2018, and is registered through CSC Corporate Domains, Inc. Infrastructure reveals it resolves to IP 35.71.142.77, hosted on Amazon Web Services (AS16509) in the United States, with nameservers under AWS DNS management. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites, and the domain previously returned an HTTP 404 status, suggesting it may have been taken down or reconfigured.

The page title, 'Trezor Suite App (Official) | Desktop & Web Crypto Management,' explicitly mimics Trezor’s branding, aligning with the reported scam type of a crypto scam. It appears on one security blocklist (PhishDestroy), though no detections were recorded by the 95 vendors that scanned it on VirusTotal at the time of assessment. The use of Framer Sites and React for hosting is consistent with modern phishing infrastructure, which often leverages legitimate development tools to evade detection.

Defenders should treat this domain as high-risk for crypto-related fraud, particularly given its explicit branding and historical presence on a security blocklist. While the domain is currently offline, monitoring for reactivation or similar domains using the same infrastructure (e.g., AWS hosting, Framer Sites, Trezor-themed titles) is recommended. No evidence of payload delivery or specific attack vectors is available, so further investigation into past activity or associated artifacts may be necessary to assess full exposure.