trezor-io-start-web-ledger-us[.]typedream[.]app

This domain, trezor-io-start-web-ledger-us.typedream.app, is actively engaged in brand impersonation phishing targeting Ledger hardware wallet users. Analysis confirms the threat type as high-risk brand impersonation, with the page falsely presenting itself as an official Trezor setup portal under the title 'Trezor.io/Start® | Starting Up Your Device | Trézór®.' The domain remains operational and poses a significant risk to users seeking legitimate cryptocurrency wallet initialization procedures. Infrastructure analysis reveals multiple technical indicators supporting the fraudulent classification. The domain is flagged by 17 of 95 security vendors on VirusTotal, indicating widespread detection as malicious. It is hosted on IP address 188.114.97.3 and registered through Typedream, a platform commonly exploited for rapid deployment of phishing infrastructure. The domain appears on three security blocklists and is actively blocked by multiple security providers. Its trust score is rated at 0/100 by Gridinsoft, reflecting zero credibility. Detected technologies include Node.js, React, Next.js, and Cloudflare, suggesting a modern, obfuscated frontend designed to mimic legitimate wallet setup interfaces. The SSL certificate is issued by Google Trust Services, which does not validate the legitimacy of the site’s content or intent. Current status indicates the domain remains active and continues to deceive users. Organizations and individuals are advised to immediately block access to this domain at the network level and update endpoint protection rules to prevent interaction. Users who may have visited the site should assume potential credential or seed phrase compromise and take immediate action to secure their assets, including revoking any connected wallet permissions and transferring funds to a new, verified wallet address. Security teams should monitor for related domains using similar naming conventions or infrastructure patterns, as this campaign may represent part of a broader, ongoing phishing operation.