trezoire-suites[.]framer[.]ai

The domain trezoire-suites.framer.ai was registered on February 21, 2026 and is currently taken offline. Intelligence indicates the site was designed to impersonate the Trezor hardware‑wallet brand, as reflected in the page title "Official Trézor Suite | Secure Hardware Wallet App" and the classification as a crypto‑scam. The domain resolves to the Amazon Web Services address 35.71.142.77, located in the United States and advertised under ASN 16509 (Amazon.com, Inc.). Nameserver records point to ns-1902.awsdns-45.co.uk, ns-635.awsdns-15.net, ns-1198.awsdns-21.org, and an additional AWS nameserver, confirming the use of AWS DNS infrastructure.

The site employed a Let’s Encrypt certificate (issuer E8) and presented modern web technologies including Framer Sites, React, HTTP Strict Transport Security, and HTTP/3, which suggests an attempt to appear legitimate and improve performance. VirusTotal analysis recorded 15 detections out of 93 scanning engines, and the domain appears on one external security blocklist. PhishDestroy has also flagged the domain, and the HTTP response returned a 404 status code, indicating that the malicious page is no longer serving content.

While the offline status limits immediate threat exposure, the documented indicators—brand impersonation, crypto‑scam intent, AWS hosting, and multiple vendor detections—demonstrate a credible risk. Defenders should add trezoire-suites.framer.ai and its resolved IP 35.71.142.77 to outbound and inbound blocklists, monitor for re‑appearance or similar sub‑domains on the same nameservers, and update threat‑intel feeds with the associated SSL fingerprint and DNS configuration. Continuous observation of AWS‑hosted domains targeting cryptocurrency users is advised, as the infrastructure can be rapidly repurposed for new malicious campaigns.