trezor-io-start-ledger-web-co[.]typedream[.]app

Analysis of the domain trezor-io-start-ledger-web-co.typedream.app indicates a high-risk phishing campaign targeting users of the Ledger cryptocurrency hardware wallet. The domain, registered through Cloudflare, Inc., was flagged by 14 of 95 security vendors on VirusTotal, though the scan does not represent a full consensus. It appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, which classify it as a crypto scam. The page title, 'Trezor.io/Start® | Starting Up Your Device | Trezor®,' suggests an attempt to impersonate both Trezor and Ledger setup processes, though the exact content and functionality of the site remain unconfirmed as it is currently offline with an HTTP 404 status. Infrastructure analysis reveals the domain resolved to the IP address 188.114.97.3, associated with AS13335 (Cloudflare, Inc.) in the United States.

The SSL certificate is issued by Google Trust Services (WE1), a common provider for both legitimate and malicious sites. Detected technologies include Node.js, React, Next.js, and Google Cloud services, alongside Cloudflare Browser Insights and Cloudflare CDN, indicating a modern web stack likely used to enhance the site's appearance of legitimacy. No nameservers were identified for the domain, which may suggest an incomplete or hastily configured infrastructure. Defenders should treat this domain as confirmed malicious based on its presence on multiple blocklists and vendor detections.

The impersonation of Ledger, a well-known cryptocurrency hardware provider, aligns with common tactics used in crypto scams to deceive users into entering sensitive information or connecting wallets. While the domain is currently offline, historical DNS and WHOIS data should be preserved for further investigation. Organizations are advised to block the domain and its resolved IP at the network level, and users should be alerted to the specific threat posed by this impersonation campaign.