treasuresuit[.]framer[.]ai

On July 24, 2026 analysts observed that the domain treasuresuit.framer.ai is currently offline but retains indicators of a brand impersonation campaign targeting the cryptocurrency hardware wallet brand Trezor. The site was registered through CSC Corporate Domains, Inc. on January 06, 2018 and resolves to the Amazon Web Services IP address 64.29.17.3, which belongs to AS16509 (Amazon.com, Inc.) and is geolocated in the United States. The TLS certificate presented is issued by Let’s Encrypt (E8) and the server advertises HSTS and HTTP/3 support. A HTTP request returned a 404 status code, and the page title retrieved during the brief live period read "Connect & Find Your Trezor," directly echoing the targeted brand name. Technology fingerprints indicate the use of Framer Sites and a React front‑end, consistent with a quickly deployed impersonation page.

VirusTotal analysis shows that six of ninety‑five scanning engines flagged the domain as malicious, reinforcing the suspicion of a crypto‑related scam. The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy mitigation service. The classification in available intelligence is a crypto scam, specifically a brand impersonation attempt designed to lure Trezor users. Nameserver records include ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns, all pointing to AWS DNS infrastructure.

Uncertainty remains regarding the exact payload or credential‑harvesting mechanism, as the site was taken offline before a full content capture could be performed. No additional indicators such as malware hashes, command‑and‑control endpoints, or phishing form structures have been disclosed. Defenders should continue to monitor DNS queries for the listed nameservers and the associated IP address, enforce blocklisting of the domain across web filtering solutions, and update threat‑intel feeds to reflect the brand impersonation risk.