start-io-trezr-lo-gin-cdn-en[.]typedream[.]app

This domain is actively impersonating the official Trezor cryptocurrency wallet login interface, designed to harvest user credentials and private keys. Analysis of the page title, "Trezor @Login | The official wallet* Secure your crypto assets with …," confirms the intent to deceive victims into believing they are accessing a legitimate wallet service. The threat specifically targets cryptocurrency holders by mimicking secure authentication portals, a common tactic in credential theft campaigns targeting digital asset storage solutions. Infrastructure analysis reveals the domain is hosted on Typedream, a platform often exploited for rapid deployment of phishing pages. As of the latest scan, only 1 out of 95 security vendors on VirusTotal flagged this domain, indicating low initial detection rates and potential evasion of automated defenses. The domain resolves to the IP address 188.114.96.3, which may be part of a content delivery network or proxy service used to obscure the true origin of the phishing infrastructure. No historical blocklist data or creation date was provided, but the domain remains active and unmitigated, increasing the risk of successful compromise. Users who have visited this domain or entered credentials should immediately revoke access to any linked cryptocurrency wallets and transfer assets to a new, secure wallet. Multi-factor authentication (MFA) should be enabled on all accounts, and affected users are advised to monitor for unauthorized transactions. Browser caches and saved passwords should be cleared to remove any stored credentials associated with the phishing site. Security teams should block the domain and IP address (188.114.96.3) at the network level to prevent further access. Given the high-risk nature of this threat, immediate action is recommended to mitigate potential financial losses.