helps-trezir-docs[.]typedream[.]app

Analysis of the domain helps-trezir-docs.typedream.app shows a high‑risk brand‑impersonation campaign targeting Trezor users. The domain was created on June 24, 2026 and is hosted on the IP address 104.21.37.85, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 label, indicating a valid SSL chain despite the malicious intent. HTTP requests return a 403 status code, and the domain’s nameserver records are unavailable (NS_NOT_FOUND).

VirusTotal scans have flagged the domain by 17 of 91 security vendors, confirming its malicious nature. The domain appears on three public blocklists and is specifically blocked by PhishDestroy, MetaMask, and the SEAL blocklist, reinforcing the consensus that the site is being used for phishing. The page title retrieved from the live endpoint reads “Trezor® Hardware® - Wallet | Getting Started®”, directly referencing the Trezor brand and suggesting an attempt to lure users into credential harvesting. Registration was performed through Typedream, a platform often exploited for rapid deployment of deceptive pages.

While the site is currently offline, the infrastructure details – including the Cloudflare edge IP, valid SSL certificate, and multiple blocklist listings – remain indicative of a persistent threat vector that could be re‑activated. Defenders should continue to block the domain at network perimeter devices, update phishing‑protection feeds with the observed indicators, and monitor for any re‑appearance of the IP or similar sub‑domains under Typedream. Additional scrutiny of outbound traffic to Cloudflare‑hosted IP ranges associated with this domain is recommended, as well as user education campaigns highlighting the misuse of genuine Trezor branding in phishing attempts.