auth-trezor-walet[.]typedream[.]app

The domain auth-trezor-walet.typedream.app is currently flagged for high-risk brand impersonation, specifically targeting users of the Trezor cryptocurrency wallet. The page title, 'Trèzōr Wallet | Getting Started | Trèzōr ® (official)', matches the legitimate branding and is intended to mislead users into believing they are accessing official resources. No explicit evidence of a drainer kit was identified in this report, but the structure and naming conventions indicate a phishing objective focused on credential harvesting or wallet compromise.

Technical analysis confirms the domain is active, resolving to IP address 188.114.96.3. The SSL certificate is issued by Google Trust Services, providing the appearance of legitimacy to potential victims. The domain is registered through Typedream and has not been taken down at the time of this report. VirusTotal analysis reveals that 3 out of 95 security vendors have flagged this domain as malicious. The site’s detection by a minority of vendors suggests either recent deployment or evasive phishing techniques. The blocklist and Google Safe Browsing statuses were not explicitly provided but are implied to be limited, given the low VT detection rate.

This domain remains active and poses an ongoing threat, especially to users seeking official Trezor wallet services. Recommended actions include immediate network-level blocking of the domain and associated IP address, user education regarding the risk of interacting with domains mimicking well-known wallet providers, and reporting the site to additional threat intelligence feeds to accelerate broader detection. Users and organizations should refrain from entering credentials or recovery phrases on this domain and monitor for similar brand impersonation attempts leveraging typedream.app subdomains.