public-trezer-suite-app[.]typedream[.]app

This domain is a confirmed brand impersonation threat designed to deceive users into believing they are accessing a legitimate cryptocurrency wallet management platform. The site mimics the Trezor Suite interface, a well-known hardware wallet application, to trick visitors into entering sensitive credentials, recovery phrases, or private keys. Such impersonation attacks are commonly used to drain digital assets from unsuspecting victims by redirecting them to fraudulent login portals or fake software updates. The domain specifically targets users of the Sui blockchain ecosystem, exploiting trust in established wallet brands to facilitate unauthorized access to crypto holdings. Analysis indicates this domain is highly malicious based on multiple technical indicators. It was registered on June 15, 2026, through Typedream, a platform often abused for rapid deployment of phishing infrastructure. The domain resolves to the IP address 188.114.97.3 and is flagged by 21 out of 95 security vendors on VirusTotal, including MetaMask, PhishDestroy, SEAL, and OISD. The SSL certificate is issued by Google Trust Services, which, while legitimate, is frequently used by threat actors to lend false credibility to malicious sites. The page title, 'Trēzor Suite | Desktop & Web Crypto® Management,' contains intentional misspellings and branding elements to closely resemble the authentic Trezor interface. Users who visited this domain should assume their credentials or recovery phrases may have been compromised. Immediately revoke any active sessions associated with crypto wallets and transfer assets to a new, secure wallet using a clean device. Enable multi-factor authentication on all accounts and monitor transaction histories for unauthorized activity. If any sensitive information was entered, consider the original wallet and all connected accounts as compromised. Report the incident to relevant blockchain security teams and local cybercrime authorities. Avoid interacting with any links or downloads from the domain, as they may contain malware designed to maintain persistent access to the victim's system.