en-trezr-ioinfo[.]typedream[.]app

This domain is flagged as an active brand impersonation threat targeting users of a cryptocurrency hardware wallet. Analysis indicates the site mimics the official onboarding interface, presenting a high-risk vector for credential harvesting and unauthorized asset transfers. The domain currently operates under investigation due to its deceptive design and potential financial impact on victims. Infrastructure analysis reveals the domain resolves to IP address 188.114.96.3, hosted on an infrastructure provider known for content delivery services. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy. VirusTotal detection metrics show 0/95 security vendors flagging the domain as malicious, suggesting either recent deployment or effective evasion techniques. The registrar, Typedream, is a platform allowing rapid domain provisioning without stringent verification, which may facilitate abuse. No creation date is available, but the absence of blocklist inclusion further indicates the campaign remains undetected by mainstream security mechanisms. Mitigation requires immediate action from security teams and end-users. Network-level blocking of the IP 188.114.96.3 should be implemented to disrupt access. Cryptocurrency wallet providers should issue warnings to users about this impersonation attempt, emphasizing verification of domain authenticity before entering sensitive information. Security vendors are advised to update detection rules to include this domain, its associated IP, and behavioral patterns such as cloned onboarding workflows. Users should enable multi-factor authentication and verify SSL certificates against official documentation to prevent compromise.