en-help-trzeor[.]typedream[.]app

On July 24, 2026, the domain en-help-trzeor.typedream.app was observed in a high‑risk brand‑impersonation campaign targeting the Sui ecosystem. The site resolves to the Cloudflare address 104.21.37.85, which is registered to AS13335 in the United States. VirusTotal records show that 14 of 91 scanned security engines flag the domain as malicious, indicating a moderate consensus among scanners. The domain appears on three external blocklists and is actively blocked by PhishDestroy, MetaMask, and the SEAL anti‑phishing service, reinforcing the perception of abuse.

The TLS certificate presented is issued by Google Trust Services under the WE1 root, which is typical for legitimate HTTPS services but does not mitigate the malicious intent. An HTTP 403 response is returned, and the page title extracted from the site reads “Trézór Suite® (Official) | Desktop & Web Crypto® Management,” suggesting an attempt to masquerade as a crypto‑management product. Registration information lists Typedream as the registrar, while DNS queries for authoritative name servers return no results, limiting further attribution.

The site is currently offline, but the infrastructure—Cloudflare fronting and a Google‑issued certificate—could be rapidly re‑activated. Defenders should continue to monitor the IP 104.21.37.85 for any resurgence, add the domain to internal blocklists, and enforce web‑gateway policies that block traffic to known impersonation domains targeting Sui. Threat‑intel teams should also request updates from the blocklist providers and consider sharing the indicator set with industry‑wide feeds to improve collective detection.