eng-treasure-suites[.]framer[.]ai

Analysis of the domain eng-treasure-suites.framer.ai indicates it was flagged for brand impersonation targeting Sui, though the domain is currently offline as of July 24, 2026. The domain was blocked by PhishDestroy and appears on one security blocklist, suggesting prior malicious activity. Infrastructure analysis reveals it was hosted on Amazon Web Services (AS16509, US) and resolved to IP 52.223.52.2. The domain was registered on January 6, 2018, through CSC Corporate Domains, Inc., and uses nameservers ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns-53.net.

Technical indicators include a Let's Encrypt SSL certificate (serial E8) and detected technologies such as Framer Sites, React, HSTS, and HTTP/3. The HTTP status returned a 404 error with the page title 'Site Not Found | Framer,' confirming the domain is no longer serving content. No detections were recorded by the 95 vendors that scanned the domain on VirusTotal, though this does not confirm safety. The scam type is classified as brand impersonation, but specific tactics or payloads remain unconfirmed due to the domain's offline status.

Defenders should monitor for re-activation of this domain or similar patterns targeting Sui, particularly those using Framer Sites infrastructure. The combination of an older registration date, AWS hosting, and Let's Encrypt SSL aligns with common phishing infrastructure, though no active threat is currently observed. Further investigation is required to determine if this domain was part of a larger campaign or an isolated incident.