en-trazor-io-starts-auths[.]typedream[.]app

This domain, en-trazor-io-starts-auths.typedream.app, is actively engaged in brand impersonation phishing targeting users of the Trezor hardware wallet service. Analysis confirms the site is currently operational and designed to mimic legitimate Trezor onboarding procedures, as indicated by its page title, 'HomeTrezor.io/Start® - Starting Up Your Device — Trezor.' The threat type is classified as high-risk brand impersonation, with the intent likely being credential harvesting or cryptocurrency wallet compromise. Infrastructure analysis reveals the domain resolves to the IP address 188.114.96.3 and is hosted on the typedream.app platform, a legitimate website builder service often abused for phishing campaigns. The SSL certificate is issued by Google Trust Services, providing a false sense of security to potential victims. Detection metrics indicate limited but concerning coverage, with 2 of 95 security vendors on VirusTotal flagging the domain as malicious. No additional historical data, such as domain creation date or blocklist counts, is currently available for this specific subdomain, though the parent domain, typedream.app, is registered through Namecheap, Inc. The domain remains active as of the latest verification, posing an ongoing risk to users who may be deceived by its authentic appearance. Security teams are advised to update blocklists with the domain and associated IP address immediately. End users should be cautioned against interacting with the site, particularly those directed via unsolicited communications. Verification of any Trezor-related URLs should be conducted exclusively through official channels, and multi-factor authentication should be enforced where available to mitigate credential theft risks.