start-io-trezrrr-cdn-en[.]typedream[.]app

This domain is an active credential harvesting site targeting users of Trezor, a cryptocurrency hardware wallet. The site presents a fraudulent login interface mimicking Trezor’s official authentication portal, with the page title 'Trezor @Login| Sing In*-io-start-public**'. Analysis indicates the domain is engineered to capture sensitive user credentials, including wallet recovery seeds and private keys, which could lead to immediate unauthorized access and asset theft. Infrastructure analysis reveals the domain is registered through Typedream and currently resolves to the IP address 188.114.96.3. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy. As of the latest scan, 4 out of 95 security vendors on VirusTotal have flagged this domain as malicious, indicating a confirmed but still emerging threat. The domain remains active, with no takedown actions observed, and continues to host the phishing content. Users who have visited start-io-trezrrr-cdn-en.typedream.app or entered credentials on the site should assume their information has been compromised. Immediate actions include revoking access to any connected wallets, generating new recovery seeds, and transferring assets to a new, secure wallet. All devices used to access the site should be scanned for malware, and browser data—including cookies and saved passwords—should be cleared. Users are advised to monitor for unauthorized transactions and enable multi-factor authentication on all related accounts. If recovery seeds were exposed, consider the compromised wallet permanently untrustworthy.