app-tresure-suit[.]framer[.]ai

The domain app-tresure-suit.framer.ai was registered on January 06, 2018 through CSC Corporate Domains, Inc. and is presently offline. DNS resolution points to the IP address 35.71.142.77, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The site served a TLS certificate issued by Let’s Encrypt (certificate identifier E8) and employed HSTS and HTTP/3, indicating modern web security settings. An HTTP request returned a 404 status code, and the page title observed was "Trezor Suite: Manage Your Crypto with Security and Ease," directly referencing the Trezor brand.

The threat is classified as a crypto scam that impersonates Trezor, aligning with the declared brand target. Infrastructure analysis shows the domain leverages Framer Sites and React frameworks, and the authoritative name servers are ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns. Detection data indicates that one of ninety‑five VirusTotal scanners flagged the domain, and it appears on a single external blocklist, where it has been blocked by PhishDestroy.

No additional intelligence such as payload samples or phishing page screenshots is available beyond the page title. Defenders should add the domain and its associated IP to network deny lists, monitor other subdomains under framer.ai for similar patterns, and enforce email filtering rules that detect references to Trezor or crypto‑related terminology. Continuous vigilance is advised because the underlying hosting platform (AWS) can be leveraged to spin up new impersonation sites rapidly.