cloud-trez-or-hardw-are-wall-et[.]typedream[.]app

The domain cloud-trez-or-hardw-are-wall-et.typedream.app is assessed as high risk, primarily due to its brand impersonation threat targeting Trezor users. This domain poses a significant risk of credential theft and financial loss by misleading users into believing they are interacting with the legitimate Trezor Hardware Wallet service.

Analysis of the domain indicates that it is flagged by 15 out of 95 security vendors on VirusTotal, suggesting moderate but notable concern within the security community. The domain is registered through Typedream and resolves to the IP address 188.114.96.3. It appears on three security blocklists, further emphasizing its malicious nature. The SSL certificate is issued by Google Trust Services, which might lend it a false sense of security to unsuspecting users. The page title, 'Trezor® Hardware® Wallet® | Getting Started | Trezor*', is designed to closely mimic the official Trezor site, enhancing the deception. The domain is currently active and uses a variety of technologies including Node.js, React, Google Cloud, Next.js, Google Cloud Trace, Google Cloud CDN, and Webpack. Notably, it is blocked by MetaMask, PhishDestroy, and SEAL, indicating that these security tools recognize its malicious intent.

To mitigate the risks associated with this brand impersonation, users are advised to verify the URL of any Trezor-related website they visit. Legitimate Trezor sites will have the correct domain ending (trezor.io), and users should be wary of any variations. Security teams and network administrators should consider adding this domain to their DNS blocklists and implementing strict SSL certificate checks to prevent access. Additionally, educating users about the potential risks of phishing and encouraging them to use reputable security tools and browser extensions can significantly reduce the likelihood of falling victim to such attacks.