homepage-suites[.]framer[.]ai

This report details the threat posed by the domain homepage-suites.framer.ai. The site impersonated the brand Trezor, presenting a page titled "Trezor Suite: Manage Your Crypto with Security and Ease." This constitutes a cryptocurrency scam, designed to deceive users into believing they are accessing the legitimate Trezor Suite platform for managing cryptocurrency assets. The primary threat is credential theft or asset theft, as the fraudulent site likely aimed to capture sensitive login information or private keys from victims.

Technical evidence confirms the malicious nature of the site. VirusTotal analysis shows 9 out of 95 security vendors flagged the domain as malicious, with detections from ADMINUSLabs, alphaMountain.ai, CyRadar, ESET, and Fortinet. The domain is hosted on a single blocklist. The IP address is 35.71.142.77, located in the United States and belonging to AS16509 Amazon.com, Inc. The domain was registered on 2018-01-06 with registrar CSC Corporate Domains, Inc. The SSL certificate is issued by Let's Encrypt (E8). Nameservers are ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns.

The domain is currently offline (DOWN/OFFLINE). Despite its inactive status, the risk level remains high due to the potential for the domain to be reactivated for further attacks. The low detection rate (9/95) and use of a legitimate hosting provider and SSL certificate indicate the site was engineered to evade basic security filters, posing a significant threat to cryptocurrency users.