tr-zor-suite-en[.]typedream[.]app

This report details a threat site hosted at tr-zor-suite-en.typedream.app. The page title, "Trézor Suite (Official) | Trezor Suite - Desktop & Web," indicates the site claims to be the official platform for Trezor Suite, a cryptocurrency wallet interface. The site is categorized as an impersonation scam, specifically targeting the Sui brand. The primary threat is that it attempts to deceive users into believing they are accessing a legitimate service, likely to harvest credentials, private keys, or trick users into sending cryptocurrency to attacker-controlled addresses.

Technical analysis reveals 7 out of 95 VirusTotal vendors flagged the site as malicious. The domain is registered through Typedream and resolves to IP address 188.114.97.3, located in the United States and hosted by AS13335 Cloudflare, Inc. The site uses an SSL certificate issued by Google Trust Services / WE1. The nameservers are recorded as NS_NOT_FOUND. Cloaking was detected via content_divergence, indicating the server delivers different content to crawlers versus users. The DOM risk score is 90 out of 100, and GridinSoft trust is rated at 0 out of 100. Technologies identified include cdnjs.

The site is currently reported as DOWN/OFFLINE. Despite being inactive, the high risk score (90/100) and multiple blocklist flags from ChainPatrol, alphaMountain.ai, Emsisoft, Fortinet, and Kaspersky indicate a significant threat. Users should avoid any interaction with this domain.