faq-eng-trezzr-web[.]typedream[.]app

The domain faq-eng-trezzr-web.typedream.app is actively engaged in brand impersonation targeting Trezor, a hardware cryptocurrency wallet provider. Analysis indicates this site functions as a crypto drainer, designed to deceive users into entering sensitive wallet credentials or recovery phrases under the pretense of device initialization. The domain remains operational as of the latest verification, posing a high-risk threat to users attempting to set up or access Trezor devices. Infrastructure analysis reveals the domain is flagged by 15 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. It resolves to the IP address 188.114.96.3 and is registered through Typedream, a platform often exploited for rapid deployment of phishing pages. The site appears on three security blocklists and is actively blocked by multiple browser extensions and security tools. Detected technologies include Node.js, React, Next.js, and Cloudflare, with hosting infrastructure linked to Google Cloud services. The page title, 'Trezor.io/Start® | Starting Up Your Device - Tŕezor,' mimics the legitimate Trezor setup process, using subtle Unicode character substitutions to evade detection. Current status confirms the domain remains active, with no indications of takedown or mitigation. Users are advised to avoid interaction with this domain and verify all URLs against the official Trezor website (trezor.io) before entering any credentials. Organizations should update blocklists to include this domain and its associated IP address. Security teams are recommended to monitor for similar Typedream-hosted domains using the seed pattern 'e2f795' and deploy network-level protections to prevent access to this infrastructure. Immediate reporting to the registrar and hosting provider is encouraged to facilitate disruption of this phishing operation.