learn-bridge-trezor-sso-autth[.]typedream[.]app

The domain learn-bridge-trezor-sso-autth.typedream.app was identified as a high-risk brand impersonation threat targeting Trezor, a cryptocurrency hardware wallet provider. Analysis confirms the domain was designed to mimic Trezor Bridge, a legitimate software component used to connect Trezor devices to browsers. The page title, 'Trezor Bridge® | Secure Connect Your Trezor® Wallet,' directly replicates official branding to deceive users into believing the site is authentic. This domain is currently offline, but prior activity suggests it was operational for malicious purposes, likely credential theft or crypto wallet compromise. Technical indicators reveal the domain was registered through Typedream and resolved to the IP address 104.21.37.85. It was flagged by 21 of 95 security vendors on VirusTotal, and appears on four security blocklists, including MetaMask, PhishDestroy, SEAL, and OISD. The infrastructure analysis indicates the use of Node.js, React, Next.js, and Google Cloud services, including Google Cloud Trace and CDN. The SSL certificate was issued by Google Trust Services, a common tactic to lend false legitimacy. Gridinsoft assigned a trust score of 0/100, further confirming its malicious nature. While the domain is currently offline, the threat remains relevant due to the potential for re-emergence under a similar or altered infrastructure. Organizations and individuals are advised to block the domain and its associated IP address at the network level. Users who may have interacted with this domain should immediately revoke any connected wallet permissions, rotate credentials, and scan systems for malware. Monitoring for similar domains using the 'Trezor Bridge' branding or Typedream-hosted infrastructure is recommended. Security teams should update detection rules to include this domain and its technical indicators in threat intelligence feeds.