get-trezor-en-us[.]typedream[.]app

This domain, get-trezor-en-us.typedream.app, is flagged for brand impersonation targeting Trezor, a hardware wallet provider. Analysis indicates the page presents itself as an official Trezor authentication portal, using the title 'Trezor® Hardware Wallet' to deceive users into submitting credentials or recovery phrases. No direct evidence of a drainer kit was observed, but the infrastructure aligns with credential harvesting tactics common in cryptocurrency phishing campaigns.

Technical indicators confirm elevated risk: the domain is detected by 17 out of 95 security vendors on VirusTotal, with registration handled through Cloudflare, Inc. It resolves to IP address 104.21.37.85 (AS13335, Cloudflare, Inc., US) and holds an SSL certificate issued by Google Trust Services (WE1). The domain appears on two security blocklists and is actively blocked by PhishDestroy and PhishingDB. No Google Safe Browsing (GSB) listing was identified at the time of analysis, though this may reflect detection latency rather than absence of malicious activity.

The domain remains active, with no evidence of takedown or sinkholing. Response actions by security providers include blocklisting and vendor detections, but the infrastructure persists, posing a continued risk to users. The use of Cloudflare hosting and a valid SSL certificate may lend an appearance of legitimacy, increasing the likelihood of successful deception. Users are advised to verify domain authenticity via official channels before interacting with any Trezor-related authentication pages. Organizations should update blocklists to include this domain and monitor for related infrastructure using the same IP or registrar patterns.