trezor-app-bridge[.]typedream[.]app

The domain trezor-app-bridge.typedream.app is currently classified as an active crypto‑drainer infrastructure. VirusTotal analysis shows that 9 out of 91 security vendors have flagged the domain as malicious, indicating a moderate consensus among scanners that the site hosts or distributes harmful payloads. The domain is listed on a single public security blocklist and has been explicitly blocked by the PhishDestroy service, confirming that at least one dedicated anti‑phishing consortium considers it a threat vector.

Registration details reveal that the domain was created through the Typedream website‑builder platform, a service often leveraged for rapid deployment of malicious sites because it provides legitimate SSL certificates and hosting without extensive verification. DNS resolution points to the IP address 104.21.37.85, an address associated with Cloudflare’s edge network, which can obscure the true origin of the server and provide built‑in DDoS mitigation that attackers may exploit to maintain availability. No additional intelligence such as Safe Browsing verdicts, Open Threat Exchange entries, SSL certificate metadata, HTTP response codes, trust‑score ratings, or page‑title information is presently available, leaving the exact content and user‑facing behavior of the site unconfirmed.

Defenders should prioritize adding trezor-app-bridge.typedream.app to network‑level deny lists, enforce DNS‑based blocking, and update endpoint detection signatures to incorporate the 9 vendor detections reported by VirusTotal. Continuous monitoring of the hosting IP and any future changes in the domain’s registration or content is advised, as the underlying infrastructure could be repurposed for further crypto‑draining campaigns or expanded to target additional cryptocurrency wallets.