en-trezor-login-public[.]typedream[.]app

This domain, en-trezor-login-public.typedream.app, is flagged as an active brand impersonation threat targeting users of a cryptocurrency hardware wallet provider. The site mimics the official login interface, presenting a page titled 'Log In | Trezor® | Sign In to Your Account* - en-trezor-io-login ...', designed to deceive victims into entering credentials or recovery phrases. Analysis indicates the domain is structured to exploit trust in the targeted brand, potentially leading to unauthorized access to sensitive cryptocurrency assets if credentials are compromised. The threat is classified as high-risk due to the direct financial implications of credential theft in this sector. Infrastructure analysis reveals the domain resolves to the IP address 188.114.97.3, with no prior detections on VirusTotal (0/95 security vendors). The domain is hosted on a platform that utilizes a content delivery network, which may obscure the true origin of the malicious activity. The SSL certificate is issued by Google Trust Services, a legitimate provider, which may further lend an appearance of authenticity to the phishing page. As of the latest investigation, no blocklist entries or historical abuse reports were identified, suggesting this campaign may still be in its early stages or evading detection through low-volume targeting. The registrar and hosting provider associated with the domain have not yet taken enforcement action. Users who have visited en-trezor-login-public.typedream.app or entered credentials on the site should immediately revoke any sessions associated with the targeted service and enable multi-factor authentication if available. Credentials or recovery phrases entered on the site must be considered compromised and should not be reused. Affected individuals are advised to monitor their accounts for unauthorized transactions and report the incident to the legitimate service provider for further mitigation. Security teams should update detection rules to include this domain and its associated IP address, while also investigating potential lateral movement within networks where credentials may have been exposed.