start-suite-trezor[.]typedream[.]app

On 24 July 2026 a technical assessment was performed for the domain start-suite-trezor.typedream.app. The site is provisioned on Cloudflare’s network (AS13335) and resolves to IP 188.114.96.3, which is geo‑located in the United States. Registration information shows the domain was created on 21 February 2026 through Squarespace Domains II LLC, a registrar commonly used for legitimate website builders. The TLS certificate presented by the host is issued by Google Trust Services under the WE1 root, indicating that the domain is served over HTTPS with a valid Google‑signed certificate.

Infrastructure fingerprints reveal a modern web stack: Node.js, React, Next.js, Google Cloud services (including Cloud Trace and Cloud CDN), and Webpack are detected, all behind Cloudflare’s content delivery layer. An HTTP request to the root returns a 403 status code and the page title “Suspected phishing site | Cloudflare”, suggesting that the site has been taken offline or blocked by Cloudflare’s protection mechanisms. Threat intelligence flags the domain as a crypto‑related impersonation campaign targeting the hardware‑wallet brand Trezor. Sixteen of ninety‑three VirusTotal scanners flagged the domain as malicious, and the domain is listed on at least one external blocklist, including PhishDestroy.

The page title and the classification “Crypto Scam” imply that the site was intended to harvest credentials or funds from users seeking Trezor services, although the current offline state prevents direct observation of malicious content. Defenders should add the IP address 188.114.96.3 and the full domain name to perimeter blocklists, monitor for any re‑appearance of the host on alternative hosting providers, and educate users that any unsolicited request to log in to a Trezor account from this domain is unauthorised.