guide-trezorsuites[.]framer[.]ai

Analysis of the domain guide-trezorsuites.framer.ai indicates a high-risk brand impersonation campaign targeting Trezor, a cryptocurrency hardware wallet provider. The domain was registered on January 6, 2018, through CSC Corporate Domains, Inc., and is currently offline with an HTTP 404 status. Infrastructure analysis reveals the domain resolves to the IP address 31.43.161.6, hosted on Amazon.com, Inc. infrastructure (AS16509) located in the Netherlands. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites, and does not inherently indicate malicious intent.

The page title, 'Trezor Suite | Official Crypto& Management App®,' explicitly impersonates Trezor's official branding, aligning with the scam type classified as brand impersonation. Detection data shows the domain is flagged by 17 of 91 security vendors on VirusTotal and appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. Additionally, Gridinsoft assigns a trust score of 0/100, further corroborating its malicious classification. Technologies detected on the domain include Framer Sites, React, HSTS, and HTTP/3, which are consistent with modern web development practices but do not preclude malicious use.

While the domain is currently offline, the historical registration date and persistent detection by security vendors suggest it was actively used in a phishing campaign prior to takedown. Defenders should treat this domain as compromised and maintain blocklist entries to prevent potential re-emergence. The use of a legitimate registrar and hosting provider underscores the need for continuous monitoring of domains leveraging similar infrastructure for brand impersonation. No evidence of specific phishing kit components or additional malicious payloads is available at this time, and the exact content of the site remains unanalyzed.