suite-app-trozrre-eng[.]typedream[.]app

Analysis of the domain suite-app-trozrre-eng.typedream.app indicates active brand impersonation targeting users of the Trézór cryptocurrency wallet. The domain resolves to IP address 104.21.37.85, hosted on Cloudflare's infrastructure (AS13335) in the United States. The page title, 'Trézór Suite® (Official) | Desktop & Web Crypto® Management,' explicitly mimics the legitimate Trézór brand, though the domain itself is registered under the Typedream platform, a service that allows rapid deployment of web pages without traditional domain registration scrutiny. Infrastructure analysis reveals the domain lacks assigned nameservers, a common characteristic of ephemeral phishing pages deployed on third-party hosting services. The SSL certificate is issued by Google Trust Services (WE1), which does not inherently validate the legitimacy of the site's content. Detection data from multiple security sources confirms the domain's malicious classification: it appears on three independent blocklists and is flagged by 15 of 91 security vendors in aggregated scans. Notably, the domain is actively blocked by PhishDestroy, MetaMask, and SEAL, indicating confirmed malicious activity in the cryptocurrency ecosystem. The domain remains operational as of July 12, 2026, returning an HTTP 200 status, which suggests the campaign is ongoing. While the exact mechanics of the scam—such as whether it employs credential harvesting, crypto wallet drainers, or fake software distribution—are not yet analyzed, the combination of brand impersonation, low trust scores, and active blocklisting confirms its high-risk status. Defenders are advised to treat this domain as malicious, implement blocking at the network and endpoint levels, and alert users to avoid interaction. Further investigation into associated infrastructure, such as linked domains or payment addresses, is recommended to assess the full scope of the campaign.