io-trezer-en-us[.]typedream[.]app

This domain is flagged as a high-risk brand impersonation threat targeting Trezor hardware wallet users. Analysis indicates the site mimics the official Trezor onboarding process, likely aiming to harvest cryptocurrency wallet credentials, recovery seeds, or install malicious software under the guise of a legitimate setup guide. The page title, 'Trezor® Hardware Wallet | Step-by-Step Getting Started | Trezor™,' reinforces the deception by closely replicating the branding and user experience of the authentic Trezor platform.

Infrastructure analysis reveals the domain was registered through Typedream on June 15, 2026, and resolves to the IP address 188.114.96.3. VirusTotal detection metrics show 20 out of 95 security vendors flagging the domain as malicious, while it appears on three security blocklists. The domain is currently blocked by MetaMask, PhishDestroy, and SEAL. The SSL certificate is issued by Google Trust Services, which, while providing encryption, does not validate the legitimacy of the content or operator. The creation date discrepancy (2026) suggests potential domain spoofing or a misconfigured registration record, a common tactic in phishing campaigns to evade detection.

Mitigation steps for this threat include immediate blocking of the domain and associated IP (188.114.96.3) at the network perimeter. Organizations and individuals should verify the authenticity of any Trezor-related communications by cross-referencing with the official domain (trezor.io) and avoiding interaction with unofficial or mirrored setup guides. Users who may have engaged with this domain should assume credential compromise, revoke access to any linked wallets, and monitor for unauthorized transactions. Security teams are advised to update endpoint protection rules to detect and block domains registered through Typedream with similar naming conventions or impersonation patterns.