en-trezor-auths-login[.]typedream[.]app

This domain, en-trezor-auths-login.typedream.app, is flagged as a high-risk brand impersonation threat targeting Trezor, a hardware cryptocurrency wallet provider. Analysis indicates the infrastructure is designed to deceive users into entering sensitive credentials by mimicking Trezor’s official login portal, as evidenced by the page title 'Log In | Trezor® | Sign In to Your Account.' No direct evidence of a crypto drainer kit was observed, but the domain’s design aligns with credential harvesting tactics commonly employed in cryptocurrency-related fraud schemes.

Technical indicators confirm the domain’s malicious intent. VirusTotal reports 4 out of 95 security vendors flagging the domain as malicious. The domain is registered through Typedream, a platform that enables rapid deployment of web pages, and resolves to the IP address 188.114.97.3. The SSL certificate is issued by Google Trust Services, which, while providing encryption, does not validate the legitimacy of the site’s content. No creation date was provided in the available data, and the domain is not currently listed on Google Safe Browsing (GSB). Blocklist monitoring reveals minimal coverage, suggesting the infrastructure may still be in the early stages of detection.

As of the latest assessment, en-trezor-auths-login.typedream.app remains active and poses a significant risk to users. The domain’s infrastructure analysis reveals no takedown efforts, and its continued operation increases the likelihood of successful credential theft. Users are advised to avoid interacting with the domain and to verify the authenticity of any Trezor-related login pages by cross-referencing with the official Trezor website. Organizations should update blocklists to include this domain and monitor for similar impersonation attempts targeting cryptocurrency platforms. The remaining risk is classified as high due to the domain’s active status and the potential for financial loss.