trzr-suites-home[.]framer[.]ai

Analysis of trzr-suites-home.framer.ai shows a high‑risk brand‑impersonation campaign targeting the Sui ecosystem. The domain was registered on 06 January 2018 through CSC Corporate Domains, Inc. and resolves to IP 31.43.160.6, an Amazon Web Services host located in the Netherlands (AS16509). The site served an HTTPS certificate from Let’s Encrypt (E8) and advertised modern web stack components including Framer Sites, React, HSTS and HTTP/3, indicating a recent deployment of a templated phishing kit. The visible page title, "Trézór Suite®™ Official App | Secure Desktop & Web Wallet Management," explicitly references wallet management, reinforcing the Sui impersonation narrative.

HTTP requests return a 404 status, suggesting the malicious landing page may have been removed or is otherwise inaccessible. Reputation signals are poor: Gridinsoft assigns a trust score of 0/100, and the domain appears on three security blocklists. VirusTotal scans flagged the domain by 12 of 91 vendors, and it is listed by PhishDestroy, MetaMask, and SEAL as a confirmed threat. The nameserver configuration (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns) confirms use of AWS Route 53.

Current status is offline, limiting immediate observation of payloads. Defenders should continue to block the domain at network perimeter and proxy layers, monitor for any resurgence of activity from the same IP or AWS account, and update threat‑intel feeds with the observed indicators. Threat hunting should focus on Sui‑related credential theft attempts and any anomalous wallet‑management traffic originating from the listed infrastructure.