base-tezro-io[.]typedream[.]app

base-tezro-io.typedream.app is actively impersonating Trezor, a popular cryptocurrency hardware wallet. This domain is designed to deceive users into believing they are accessing the legitimate Trezor startup page. It has been flagged as malicious by 6 out of 91 vendors on VirusTotal, indicating a significant level of threat recognition within the cybersecurity community.

The domain is registered under Typedream and is hosted on an IP address managed by Cloudflare, Inc., located in the United States. The SSL certificate is issued by Google Trust Services, which may lend an air of legitimacy to unsuspecting users. The page title, "Tŕezor.io/Start® | Starting Up Your Device | Trézór®", cleverly uses special characters to mimic the official Trezor branding, further enhancing its deceptive appearance.

PhishDestroy, along with MetaMask and SEAL, have included this domain in their public blocklists. This proactive measure helps to mitigate the risk posed by the site. The early detection by PhishDestroy on June 22, 2026, highlights the effectiveness of our upstream monitoring systems, capturing threats before they propagate widely across antivirus databases. This domain exemplifies the ongoing threat of phishing attacks in the cryptocurrency space, emphasizing the need for continuous vigilance and robust security measures.