help-treezor-suite-cdn[.]typedream[.]app

The domain help-treezor-suite-cdn.typedream.app was observed hosting a brand‑impersonation page that masquerades as the Sui ecosystem, as indicated by the page title “Trézor Suite® (Official) | Desktop & Web Crypto® Management”. The site was registered through Typedream and served content via a Cloudflare edge node (IP 172.67.206.36, ASN 13335, United States). TLS termination was provided by Google Trust Services using the WE1 certificate chain, and the HTTP response returned a 403 status code, suggesting the site was taken offline at the time of analysis. Infrastructure fingerprints show a stack built on Node.js, React, Next.js, Google Cloud services (including Cloud Trace and Cloud CDN), and Webpack, all delivered through Cloudflare’s CDN.

The domain appears on three public security blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the high‑risk classification. VirusTotal scans flagged the domain in 13 of 91 vendor engines, providing additional independent confirmation of malicious intent. While the exact phishing page content cannot be verified because the site is currently inaccessible, the combination of brand‑impersonation cues, the technical stack, and the multi‑vendor detections constitute strong evidence of a targeted credential‑ harvesting or crypto‑related scam aimed at Sui users.

Defenders should continue to block the domain at perimeter filters, update DNS‑based blocklists with the observed IP and hostname, and monitor for any re‑hosting attempts that may reuse the same infrastructure or page title. Incident response teams should also scrutinize outbound traffic to Cloudflare and Google Cloud endpoints originating from internal assets, as compromised credentials could be leveraged to access similar services. Because the site is offline, ongoing observation is warranted to detect potential re‑activation or migration to new domains.