auth-public-trezor-sso[.]typedream[.]app

This domain, auth-public-trezor-sso.typedream.app, is flagged as a high-risk brand impersonation threat targeting Trezor, a cryptocurrency hardware wallet provider. Analysis indicates the site mimics Trezor’s single sign-on (SSO) infrastructure, presenting a fraudulent login interface designed to harvest user credentials. The page title, 'Trezor® Hardware® - Wallet | Getting Started,' reinforces the deception by replicating official branding, increasing the likelihood of successful phishing attempts against Trezor users. Technical indicators confirm the domain’s malicious intent. VirusTotal reports 3 out of 95 security vendors have flagged the domain, a low but notable detection rate suggesting targeted or evasive tactics. The domain is registered through Typedream, a platform often abused for rapid phishing site deployment. Infrastructure analysis reveals it resolves to IP address 188.114.97.3, a Cloudflare-associated endpoint commonly used to obfuscate hosting origins. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy. No creation date is publicly available, and Google Safe Browsing (GSB) status remains unconfirmed, though the domain is not widely blocklisted at this time. The domain remains active as of the latest verification, posing an ongoing risk to Trezor users. Response actions should include immediate blacklisting by security providers, takedown requests to Typedream, and DNS sinkholing for the resolved IP. Users are advised to verify domain authenticity via official Trezor channels before entering credentials. The remaining risk is classified as high due to the domain’s active status, targeted brand impersonation, and low detection rate, which may delay widespread mitigation efforts.