web-tre-zor-walle-t-faq[.]typedream[.]app

This domain, web-tre-zor-walle-t-faq.typedream.app, is actively impersonating Trezor, a hardware cryptocurrency wallet provider, to deceive users into disclosing sensitive credentials or installing malicious software. Analysis indicates the site presents itself as an official Trezor Wallet management portal, complete with branding elements and a fabricated page title: 'Trezor Wallet® (Official) | Desktop & Web Crypto® Management.' The threat actor’s objective is likely credential harvesting or the deployment of crypto-draining malware, given the domain’s focus on cryptocurrency users and its presence on multiple security blocklists. Infrastructure analysis reveals the domain is hosted on the Typedream platform and resolves to the IP address 188.114.96.3. It holds a Gridinsoft trust score of 0/100 and is flagged by 2 out of 95 security vendors on VirusTotal. The domain appears on three distinct security blocklists and is actively blocked by at least three security entities, including PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Google Trust Services, which, while not inherently malicious, is often leveraged by threat actors to lend a false sense of legitimacy to fraudulent sites. Users who have visited web-tre-zor-walle-t-faq.typedream.app should immediately revoke any sessions or credentials entered on the site. All passwords, recovery phrases, or private keys associated with Trezor or other cryptocurrency wallets should be considered compromised and replaced. Devices used to access the domain should undergo a full security scan to detect potential malware infections. Additionally, users are advised to monitor their cryptocurrency wallets for unauthorized transactions and enable multi-factor authentication on all related accounts. If financial loss is suspected, affected parties should report the incident to relevant authorities and their cryptocurrency exchange providers.