help-trezor-suite[.]typedream[.]app

help-trezor-suite.typedream.app is currently listed as an offline site that was used for a brand‑impersonation campaign targeting the cryptocurrency hardware‑wallet provider Trezor. The domain was registered on 21 February 2026 through Squarespace Domains II LLC and resolves to the Cloudflare address 172.67.206.36, which is assigned to AS13335 in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 designation, indicating a legitimate certificate chain but offering no protection against malicious content. An HTTP request returns a 403 status code, suggesting that the site is no longer serving pages.

Automated analysis identified a stack consisting of Node.js, React, Next.js, Google Cloud services, Cloudflare CDN, and Webpack, all typical of modern web applications but not indicative of the payload. The page title reported by scanners is “Tr𝔢zor Suite (Official)”, directly referencing the Trezor brand. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist, having been blocked by the PhishDestroy service. VirusTotal records show that ten of ninety‑three scanned scanners flagged the domain as malicious, reinforcing the suspicion of a crypto‑related scam.

The overall risk rating is elevated, although the site is presently offline. Defenders should continue to block the domain and its associated IP address at perimeter defenses, add the domain to internal blocklists, and monitor for any re‑registration attempts. Additional investigation of any residual content, especially the “Tr𝔢zor Suite (Official)” page, would be required to confirm the exact phishing vector, but the available infrastructure evidence already substantiates a targeted impersonation campaign.