welcome-suite-treoz[.]typedream[.]app

Analysis indicates that the domain welcome-suite-treoz.typedream.app was registered on 21 February 2026 through Squarespace Domains II LLC. DNS resolution points to the IPv4 address 104.21.37.85, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site served a TLS certificate issued by Google Trust Services under the WE1 identifier, confirming the use of Google’s certificate infrastructure. HTTP probing returned a 404 status code, suggesting that the landing page is no longer publicly reachable at the time of analysis. The page title observed during earlier collection was “Trezor™ Suite | (Official) | Desktop & Web Crypto® Management”, and the underlying stack was identified as Node.js with React and Next.js, hosted on Google Cloud and delivered through Google Cloud CDN and Cloudflare services, including Cloudflare Browser Insights.

The domain is classified as a brand‑impersonation crypto scam targeting the Sui ecosystem. Ten of ninety‑five VirusTotal scanners flagged the domain as malicious, and it appears on a single external blocklist, where it has been listed by PhishDestroy. The risk rating is elevated, although the current status is offline.

Defenders should continue to block the host IP 104.21.37.85 and the fully qualified domain name, update any URL filtering rules to include the domain, and monitor for re‑use of the same registrar or hosting provider in future campaigns. Because the site is no longer serving content, active takedown actions are limited, but threat‑intel sharing with sink‑hole operators and inclusion in reputation feeds will help prevent resurgence. Attribution beyond the observed infrastructure remains uncertain; no additional malicious payloads or command‑and‑control endpoints have been disclosed.